I found - from doing exactly what you're doing - that if you choose the route of locking *anything* down, then that will very quickly become the majority focus of your day. However, you do have a responsibility as each one of those laptops is a lawsuit waiting to happen.
That being said, the suggestions that you "don't lock anything down" is ludicrous. You wouldn't tell kids they can take the school bus for a drive would you? That's reckless, and while ownership is something that everyone wants to encourage, it's not realistic to expect 100% participation. The best way to encourage respect for the laptops is to set up a very straightforward policy that requires two things: 1) parental involvement 2) real financial damages in the case that gross negligence is involved with the loss / damage of a laptop.
We had parents sign a binding contract and every student had to pay a nominal laptop fee. We also had a MANDATORY assembly in order to take the laptops home each year. During the assembly, we covered care instructions and the school's acceptable use policy for both the computers and laptops
In the case of damages, we had a committee of students, teachers, and parents that evaluated and meted out what punishment or damages should be assessed. It wasn't perfect, by any means, however having a system in place for handling the disaster that will happen is essential for success. Sticking to that system is even a greater challenge.
Technically, if you want to lock everything down, let me make some recommendations:
1) set a firmware password that is significantly different from the admin password.
2) set an admin account with a password that can't be easily guessed and hide it from view
3) invest in Lightspeed Systems. It's a little app that tracks where students go and what they do on the internet. Just confronting kids with that info is helpful in controlling illicit behavior. Make sure your guidance counselor is on board and has some resources to deal with internet addiction and porn addiction.
4) Set up a lo-jack system for recovery. This can be as simple as a startup script that submits the machines IP, current user, and any other relevant info to a server. There are more expensive systems out there that allow. Here's a free one:
5) RADMIND! Use it!
6) Let kids know that the policy for broken machines is reimaging them. Reimage remotely using DeployStudio:
http://www.deploystudio.com/
7) Move all the apps that students never need into a folder and hide it and change the permissions so they can't run the programs unless they're in the admin group
8) Join the apple sysadmin's group. It's worth the read.
