I will try to formulate the question as precisely as possible. There is a computer with XP. It contains very rare and expensive software. In a single instance, of course. The decision was made to shield the computer from the maximum number of influences, to put the system unit in a safe Deposit box(or a semblance of the safe). Now we need to make it so that users can work, but could not make any changes to the system, nothing could remove. Roughly speaking, the rights only on reading.
Maybe someone will be able to suggest how best to organize everything?