IIRC there's a restricted services section under windows settings in the computer configuration section, if you have an AD domain. Its not an option on standalone PCs, and I think it requires XP.