Exactly!

As far as I am aware WMP will still tell you that it doesn't recognise the media and ask for permission to go look for a codec, rather than just "do it"?

Anyway, wouldn't your setup prevent software installations and updates from a user account?

I know that there are third party tools that do this, as well as being able to create restricted accounts within Windows.