Securing Windows for a lab (Score 1)

I run a grad-school lab, and what we do sounds a lot like what you need.

I think you're saying that you have a single account on each machine that every student logs in as. If that's the case, enable the "Guest" account, and let students use that (passwordless) account to log in. the Guest account has the tightest restrictions, and most of the things you can change as Guest get wiped away by a simple reboot. This is what we do, with the systems set to automatically log in as Guest - see http://www.kellys-korner-xp.com/win_xp_passwords.h tm for details.

If I'm wrong, and you need individual accounts for each student, then you'll need Windows XP Pro on every machine and some flavor of domain controller (SaMBa does a dandy job for us). Make your student accounts members of the "Domain Guests" group, and viola!

One other note: ditch the "administrator" account. It's trivial to find tools that will let a person reset the password of the default "administrator" account. Create another administrator-level account, then delete or disable "administrator".

This being Slashdot, somebody of course suggested that you "put Linux on it", but in this case they might be on the right track. We have a general-use lab that is running Ubuntu with Crossover Office, and the users are happy as clams (and these aren't techies, folks - these are writers, pastors, and chaplains). We use a single shared unprivileged account with automatic login (similar to what I described above for Windows), and everything works beautifully. It's also more stable than the Windows lab, which makes everybody happy!