How to stop user changes while still having general control of sys

I have 7 computers XP PRO connected to the internet through a router/dsl
modem, is there a way to let users have access to main functions (downloads,
hotmail/yahoo, install cameras & devices etc) without letting them change any
main system settings in windows or anti virus.

Tired of reloading every couple of months.

thanks for any advice or point to the right direction