Restrict user access in Windows Vista to only run installed programs

"You need to specify permissions for all programs. The easiest way would probably be to deny execute permissions to everything under Program Files and then allow it for the programs you want to allow.

As for the file system, a non-admin account only has read access to the file system outside his profile anyway, you can take away the permissions to list folder contents, though."

On the Home editions, use Parental Controls. It's a form of Software Restriction Policy, as you'll see if you look in Event Viewer for the actions Parental Controls has denied. It's not without its hassles, but that's how it is with execution controls. I'll still take it over a six-hour malware-removal battle :)