zoomer, you can do it through Domain Control Security this will as it inferes do it across the whole Domain. You could do it via the Local Security. If it is only certain users that you want to disallow then do it through the Group Policy of the OU of those users. Right click the OU, select the Group Policy of the OU, click on the Edit button. Navigate down the tree on the lift and select Administrative settings, from here select Control Panel. Then select "Prohibit access to the Control Panel"
click here for a look at the Group Policy.