Server 2003 and IE downloads

[protias]

I was hoping someone would be able to help me here. I am running Server 2003 as the domain controller and users are on Linux FC4 and logging into through Citrix to do their work on the network. I have locked down the machines from downloading in Active Directory. Here is the odd thing, users are still able to download even after I tested it with download.com. Users are downloading pictures and online games (such as from Yahoo). I have searched for the last 2 hours and am unable to find anything that is real relevant to help me prevent users from these downloads.

Edit: I have also locked it down so users are unable to install software.

[MorfiusX]

1 - Don't let users run as admins.
2 - Use a proxy server/gateway to control internet access.
3 - Use software restrictions and block the offending executables from being launched.