"There have been recent security issues with unauthorized software installed on company computers. This is a reminder that installing software on any computer without permission from IT is a termination offense. In the past this has been forgiven; that is no longer the case and those responsible *will* be terminated. The company cannot continue spending money unnecessarily to re-image infected computers."
arnold
In a workgroup environment, make sure all the users except those who should have rights to install are standard users.
In a workgroup environment, you will have to make X number of computer/users changes.
Since you have pro version of windows, you could use an older workstation and setup SAMBA 4 + AD DC environment where you can centrally manage users and computers. simplifying some of your issues.
Look at getting windows Server essential....
Some applications can be installed within the user profile.
you are not descriptive...
using GPedit you could use software restrictions though as noted earlier you would need to do this on each workstation....
"There have been recent security issues with unauthorized software installed on company computers. This is a reminder that installing software on any computer without permission from IT is a termination offense. In the past this has been forgiven; that is no longer the case and those responsible *will* be terminated. The company cannot continue spending money unnecessarily to re-image infected computers."