In response to Mr. Grimes' zero-tolerance policy on installing software:
My problem with desktop lockdowns is that these are often accompanied with an "IT knows best" mentality. You know, the motto that "we'd have a great IT system if it wasn't for all these pesky users".
Yes, users install lots of crap on their workstations, but there are valid business needs there as well.
If IT forgets that it is there to serve users, then it is a hindrance, not a help. Desktop lockdowns can serve a valid purpose, but if users can't create their own solutions, you better make damn sure that IT is prepared to help find solutions for them.