Setting up an account in XPP that won't "hurt" the system?

> Hi all,
>
> I need to setup an account that can read and execute
> all of the installed programs in XP Pro but can not
> modify or "hurt" the system with installs. The
> regular "user" account can not execute non-certified
> MS programs and the poweruser account has the
> ability to do installs which I don't want for this
> account. Can I setup a custom group that has the
> characteristics I seek and put this account in it?
> Example of one problem: user account can not run
> OpenOffice after installed by another account that
> has higher privileges. This is on a standalone
> machine.
>
> any ideas?
> charles
>
>