You'll be surprised that they can spend many hours running Flash or Java straight off websites. I would however load TuxPaint and shortcuts on the desktop to some safe and attractive starting points like Club Penguin as well as your choice of national broadcasters "kids" site (e.g. Australia - ABC for Kids, US - PBS Kids, Japan - Kids World).

The main thing though is to control logon time using NET USER. I'd only allow a one or two hour slot each day and one or two rest days with no access permitted. Be brutal and blame the computer when it says "logon has time limits".