I am a high school student at a school with an 'net admin' that somewhat lacks in knowledge, so I have been running their network and security for about a year now. Microsoft Shared Computer Toolkit
was a great help in locking down the machines. I allowed access to basics such as Firefox and Open Office (the school isn't much into purchasing licenses so it opens opportunities for me to install open source software) and locked down everything else. Preferably each student would have their own account but with some networks (such as the one I run) this is not possible (to many students and not enough resources). So, I set aside a specific folder to which students can save documents. This folder is limited to 15MB to prevent storage of large files that they do not need access to. Then I have VNC and various keyloggers installed and the background image is a ULA stating that EVERYTHING they do will be monitored. This system seems to work fairly well, though it could use some improvement in some areas, but, for limited resources it is not to bad.