By the very ability of Group Policy Management you can very easily become a network manager from hell, by locking down the system so that it in deed is secure, but at what cost..
I have found that the best way of ensuring that staff can fully undertake their role without having to constantly hear that there is something stopping them is to make sure that they have all the tools they need at their disposal when they need them.
Locking down systems to stop people from right clicking on menus, or installing software is a thing of the past for me. I prefer to run with a policy of honesty and trust. When issuing the laptop to the member of staff I explain that they have the rights to be able to install software, such as printer drivers, or a useful piece of report writing software. I also ask that before they install any software they ask permission to do so, this goes down well with most members of staff, and you often find that they come up with some very good free software solutions.