An administrative account.... (Score 1)

Taking ownership of .cpl and other unnecessary items the students do not need to begin with. (games, run, windows installer, services, control panel and more i'm sure i'm not listing) Group policies are a godsend. A Domain controller/proxy server would be a good idea. (It's easier to control network traffic through one machine, with the DC you can backup each students individual profile every time they log off, use deep freeze to reset the machines to install spec on a restart and then have everyones files in one place for virus/adware/malware scans.) Configure filetype associations to programs that wont run what it is they shoulndt be accessing. (Paint wont open an mp3 divx avi exe swf whatever)