i have a 3-computer environment in an afterschool program that already has netnanny on them, but i'd like to lock down the desktop, c drive, control panel, etc so some bright young kid don't mess up the computer setup just to see if he/she can. i want them to only have access to the IE icon to go to approved websites. netnanny takes care of the websites, but i can't use active directory as its on a workgroup, and i've tried to use gpedit.msc to lock the environment, but even the built-in admin is locked down in this way - i can't go back and change anything after using gpedit if i needed to cause it locks down the built-in admin as well.
i'm sure there's a software product that can do this, but the owner doesn't want to spend the money or time finding the software - i want to set it locally on each system for him. the guest account does not fully lock out a user's privileges - is there even a way in a workgroup to lock down the environment but still maintain an admin access to manipulate it if needed?