I would set the proxy via policies and take away the connections tab in IE via policies as well. That way they cannot change the settings back. This should not be hard to do since they are all Win2k clients.