I need to lock down a workstation so a local user named "Assistant1" can not launch any applications except Notepad.

Can anyone tell me where to start?

The OS is Windows XP SP2 or SP3. The computers are connected to a domain the user is a local user that is not an administrator (It's in the Guest group)