[greffov]

You can create a new user, of the default group guest, which can't install software and do things which has something to do with the OS.

If you wan't to restrict access for a certain user for your files, you need to have NTFS formatted drives. You can change the accesscontrol list of files, folders and drives (I think). You can explicitly exclude usernames to read, write, append and delete.

However, if you want some user be able to log in on your workstation, and be able to work, all program files should be readable for that user. Don't experiment with restricting access to system files, in the worst case your PC won't boot again.

Overall advice: only change the permissions for folders and files which contain documents and stuff you created yourself.