yup .. i agree with "mohaugn" .. if your computer in domain network .. it will be easier if you set the user from the server. by giving them "user" trustee. i forget about the detail. but the options is in your server already . it is like start/programs/administrative tools/active directory user or computers ( i forget about this ). but i think you can set everyone who insert your network by give them "user trustee".
there are so many trustee in there .. don't give them adminnistrator or domain admins, it will allow them to do anything to the computer or even they can changet the IP address or etc.
or you can saw their activity by wingate server ( you must installed it in your server ) and wingate client ( install it in each clients ) . you can see what their activities and you can choose the user may or may not do what you want .