blocking executable downloads

Anyone experience of preventing networked users (windows 2000 sbs, mainly xp
pro clients) from downloading exectuable files?

One of our users keeps downloading Macromedia Flash based games and other
executables.

I have been playing with a new rule in ISA Server, need to add a few
exceptions though for safe sites, such as downloading symantec updates and
letting windows update work etc.

Any other ideas?

Andy