Slashdot Mirror

I know you're asking to pay to offload this duty, but I have a suggestion that perhaps you should consider. I would encourage you to consider keeping those duties for yourself, and add a new application to help protect them all the way around.

Deep Freeze by Faronics - http://www.faronics.com/produc...

This product will let you create the perfect configuration for your parents, then 'freeze' it in place. They can have places for documents to go that you can edit and change and so forth. But, if you get infected with something, or an application installs something extra you didn't want, or your browser gets fouled up, you reboot your computer and Deep Freeze makes your system revert back to what it was before those changes took place.

If they aren't changing or updating their system regularly, they just wait until you can do that for them, on your schedule. If they have problems, they reboot and get a working computer back. You'll still want to backup their documents, but you can use a cloud solution for that, so it'll be set-it and forget-it, except when it's time to pay the yearly bill.

It's juts something to consider. Again, I know it's not the hands off solution you're thinking about, but as your parents get older, they'll appreciate your help all the more. It lets you still use this to be connected to them, and feel more like you're taking care of them than pushing that duty off on someone else. Your time is worth way more than the money you spend on them.

Do you run Windows? Ever? At all? Then WAKE UP! You are also part of the botnet. Welcome. Come on in. The water's fine. There is nothing you can do about it because none of the detection software will detect the really good stuff. If' it's detectable then it's avoidable. I would guess that non-pirates make up a larger percentage of the botnet than pirates. It's that false sense of security that does you in.

Do you run an executable whitelisting application? Sandboxie? Do you ever allow javascript or flash to run in your browser? Daily virus scans from more than one of the better rated apps? Do you routinely run sysinternals process explorer and stay intimately familiar with every process that should normally be there so that you can detect suspicious ones? Do you run an open source firewall that will detect every outbound connection attempt no matter how subtle and clever? Even if you do all of this you are probably still part of the botnet if you run Windows. A false sense of security will not keep you safe.

Keep backup images handy and re-blast them if something is fubar.

Almost the right answer.

I'm the one-man IT department at a nursing home. I generally don't provide tech support to our residents, though there are are a few PCs in our library that I'm expected to keep up and running. In addition to the risk of malware, there's always the chance that some "knows enough to be dangerous" user will seriously screw something up.

The answer is here: http://www.faronics.com/products/deep-freeze/ (No, I don't work for them, this isn't a paid endorsement, that's not even a referral link.) Set the PC up once the way it's supposed to be, then install Deep Freeze. Any time you boot the PC, it's back the way I set it up. Aside from hardware failure, any problem that comes up is as simple as, "Have you tried turning it off and then on again?" Staff shuts down the library PCs every night, and I told them to just hit the switch on the power strip. Why bother with a proper shutdown when there's nothing to be written to the hard drive anyway. Next time it boots up, Windows doesn't know it wasn't shut down properly. I don't bother running AV software on those machines. Once a month, I un-freeze them, run Window Update, then re-freeze.

The basic version of Deep Freeze is $45/seat. At a typical IT salary, it pays for itself pretty quickly in avoiding re-installs. The only thing to watch out for is not to use the "boot thawed on next boot only" option when running Windows update. Sometimes you'll get updates that need to run stuff after reboot, then reboot again, and you can get stuck in a boot loop. (There is a fix available.)

If you really need a free-as-in-beer solution, I remember years ago stumbling on instructions for doing something similar with XP by using the Enhanced Write Filter software from XP Embedded. If interested, you can do your own Googling, and I have no idea whether this involves violating licensing agreements or copyrights.

DeepFreeze is awesome. Buddy of mine once owned a cyber-cafe. He allowed administrator access on all his PCs. His customers, who were pretty much all young males between the ages of 15 and 25, (no risk from that demographic, no), were free to install whatever games or hideously infected viral crap they wished. After they were done abusing their rented PC, my buddy would simply poke the reset button, and the machine would boot back to its pristine state.

I've had pretty good luck running Deep Freeze in cases like this.

With deep freeze, you set up your computer up into the ideal state you want it and then "freeze" it. Users can use the system to their heart's desire, and then you can restore it to the ideal state by rebooting the box.

wikipedia article about it: http://en.wikipedia.org/wiki/Deep_Freeze_(software)

Product website: http://www.faronics.com/products/deep-freeze/

I would suggest installing Deep Freeze Have it unfrozen when you yourself are using it. Freeze it before your guest uses it, Then one simple reboot and every single thing is back to how it was when it was frozen. Then just unfreeze for you to continue using it as a normal computer. We use this program on our WiFi Cafe computers after getting very tired of having to 'repair' the software about once a fortnight to clear various plug-ins, add-ons, programs etc that the users were installing. With Deep Freeze we have just set all the options as we need, then freeze it. No cookies left, no temp internet files, any virus or installed programs or anything is obliterated on reboot. Works great.

One way is to just make a guest account.

But if someone wants admin rights to install a game or something, you can use Faronics Deep Freeze or Fortres Grand Clean Slate to ensure that no changes to the Windows filesystem survive reboots or even log-offs.

Deep freeze kicks ass. http://www.faronics.com/products/deep-freeze/standard/

Granted, I use it for my tween-aged nieces on their PC's. Tell Mom and Dad the thaw password so they can run updates and install software, set up some thawed space for My Documents, and forget about it.
They can install every piece of spyware known to man, one reboot and it's all fixed.

For those users that are prone to infections and re-infections (and insist on using Windows) I set them up with Deep Freeze. I setup the OS with all the software and settings they will need. I create a seperate partition for their Documents and Firefox/Chrome/Thunderbird profiles. I then "freeze" the C:\ drive. There is no A/V to annoy the user and generally slow everything down. If the computer becomes infected you just reboot and the infection is gone. Occasionally you will have to temporarily "thaw" the C:\ drive to add/remove software, install updates, or make changes.

It sounds like you may like Deep Freeze. http://www.faronics.com/enterprise/deep-freeze/

It costs a bit, but pretty much on every restart it will revert any "frozen" drives to their previous state, this is usually done in unison with a second partition that is "unfrozen" so people can save files... And if you want to update your system, you can turn Deep Freeze off temporarily. It also has a user permission system so some people can save files.

Fantastic for management, and as someone who was on the user end of it for a while, it wasn't that bad because of the unfrozen drive for my files. (You could permanently install with a password if you needed to)

Those "troublemakers" should be encouraged to do just that. Those are the ones that will do well in computing and it can be used as an effective tool to engage them. Sure you'll have to do some clean up on occasion but it's better than shutting them down on something they show skill at.

Let the students do what they will on the computers, so long as they're completing what you've asked.

- Depending on your OS: Deep Freeze http://www.faronics.com/enterprise/deep-freeze/ on every computer.
- Give them a honeypot to hack into and poke around
- Human interface devices. Let them see how their actions on a computer can do something in the real world. LEGO robotics software is great for this stuff.
- Software to allow integration with other classes... doing a catapult launch in science? simulate the physics and test designs before making them. Algebra? Link it to programming. etc
- Build in problems for students to diagnose/resolve into your software and hardware setup. Nothing complicated but problem solving is the best way to learn computers imo.

Whatever you do, never treat someone as a troublemaker.

Uhhh...you DO know there is a butt simple way around this, yes? 1.-Install the software, 2.-Install Deep Freeze or other similar software. 3.-There is no step three because at every boot you have a clean system and if there is any doubt at any time a simple reboot gets you a clean slate.

Now personally I wish MSFT would have simply built this ability into the OS, but with antitrust they'd probably be slammed by both the AV and the companies like Deep Freeze if they tried it. They offered a free version on XP called Steady State but they never bothered to update it and quietly let it die.

But in the end you really can't blame MSFT for this one, since their recommendations on writing permissions has been the same since Win2K pro, it is just nearly every third party vendor just gave MSFT the bird and wrote everything as admin because it was the lazy way to go. But if you are dealing with a vendor who after FOUR YEARS of UAC STILL hasn't bothered to write an acceptable program with normal permissions I would seriously be pushing for another vendor. After all if they can't even code correct permissions, what other shoddy code have they let slip by?

"1. The process takes entirely too long and if the person doesn't wait and walks away or just turns it off, the thief could still get the data. They used rdist when I was in college for campus kiosk computers. It was fucking miserable to wait for one of these bastards to boot or shutdown in the case of there being a problem which required a reboot (at the time a frequent necessity)."

Eww, yea that's not the best way to do it at all (Having to wait on anything that is.)

For Windows XP I use a program called Windows SteadyState, which unfortunately Microsoft seems to be discontinuing as so far as not supporting any OS past XP 32bit.

There is also a commercial solution known as Deep Freeze that does the same task but for a lot more operating systems.

Basically all your root drive / C drive changes are held in memory in a separate copy-on-write partition that appears merged with the real data.
None of the FAT entries are maintained for that outside of RAM however, so even yanking the plug will do the same thing as a normal shutdown, and there is no waiting beyond what you wait now to reboot. All changes to the drive just instantly disappear and the drive space is reclaimed.

The computer labs at Cornell already use Deep Freeze.

"1. The process takes entirely too long and if the person doesn't wait and walks away or just turns it off, the thief could still get the data. They used rdist when I was in college for campus kiosk computers. It was fucking miserable to wait for one of these bastards to boot or shutdown in the case of there being a problem which required a reboot (at the time a frequent necessity)."

Eww, yea that's not the best way to do it at all (Having to wait on anything that is.)

For Windows XP I use a program called Windows SteadyState, which unfortunately Microsoft seems to be discontinuing as so far as not supporting any OS past XP 32bit.

There is also a commercial solution known as Deep Freeze that does the same task but for a lot more operating systems.

Basically all your root drive / C drive changes are held in memory in a separate copy-on-write partition that appears merged with the real data.
None of the FAT entries are maintained for that outside of RAM however, so even yanking the plug will do the same thing as a normal shutdown, and there is no waiting beyond what you wait now to reboot. All changes to the drive just instantly disappear and the drive space is reclaimed.

(while I like the Get A Mac suggestion, perhaps something more windows-zealot-friendly...)

or get something like Deep Freeze and have it simply restore the HD to factory every 2am. And use network home folders and shares for documents.

Then you have ONE place to run the malware/av software on, the server's shares, at 2am while all the machines on the floor are reimaging themselves for tomorrow.

(there's no point in suggesting something that they're unlikely to try even if you can make a good case for it or in fact are offering a very competitive suggetsion)

Perhaps you should try "Anti-Executable" by the same company that makes Deep-freeze and other security software, Faronics. Here's a link to it: http://www.faronics.com/en/Products/AntiExecutable/AntiExecutableCorporate.aspx It's not automatic though, I think you have to actually set up the list of programs that are allowed to run. Also note that a lot of stuff uses one .exe to spawn other .exe files, so you can't just whitelist the .exes linked to in your application shortcuts.

Businesses certainly run Macs but they really don't have any great centralized administration tools. Apple Remote Desktop and Open Directory aren't nearly as powerful out of the box as Active Directory and its accompanying tools. There's nothing comparable to Exchange server that I know of. MacOS is to business desktop computing in much the same way linux is...you can use it, but you need to develop the tools for administering it (or use some open source tools, etc).

Problem: Adminstrating a lot of macs.

Solution: Products like Deep Freeze.

http://www.faronics.com/html/DFMac.asp

Combine that with restricting macs to network logins with home directories stored on the server and you have one central point for configuration management and backup of user data.

Oh, wait. You wanted "enterprise" solutions that require your constant attention so you can justify your existence. Sorry about that.

Deepfreeze. http://www.faronics.com/html/product.asp -- Deepfreeze pulls a disk image from another computer every boot. If it gets infected, just reboot. They would have to a) not install any software or software updates until you got there, and b) have a data partition for any locally stored files, although with Flyword -- that isn't necessary. Flyword will even put an icon on their desktop, and store stuff online. It's a Java app.

http://www.flyword.com/ (it's been around since before Google docs.)

You may also want to look at Zonelabs' Forcefield. It essentially sandboxes the browser, and wipes off any downloads and returns the browser to a pristine state. http://www.zonelabs.com/

--Sam

You could look into some sort of program, such as Deep Freeze http://www.faronics.com/.

I teach physics at a community college, and I recently made a big push to get proper power management set up in the science division's computer labs. It ended up being orders of magnitude more work than I thought it would.

I had seemed like a total no-brainer to me. We had 42 desktop Windows machines in our student computer labs. They were running 24/7. They had CRT monitors, and they were configured so that when they weren't being used, they ran a waving flag animation on the screen, meaning that both the CPU and the monitor were drawing full power. Here we were teaching our students about global warming, but we had this ridiculously wasteful configuration.

The first issue was that, as the slashdot summary suggests is common, nobody really cared, because it was some other part of the organization that was paying the electric bills.

The second issue was that when I approached IT, they wanted to handle it using software called Deep Freeze, which not only handles power management but also automatically restores the computer's hard disk to a known state every so often. This is in principle a good idea, because it means that students can't screw up the machines, and it's another layer of defense against malware. However, it opened up a whole can of worms, because if they were going to make this new hard disk image, they wanted to make sure it was done right. They wanted to update the OS, and install all the apps from scratch. Well, we had a ton of apps dating back to ca. 1995 that were still being used for instruction, but nobody could find the licenses for them. So that became a huge issue. It was one that we would have had to deal with sooner or later anyway, but it was a clear example where the easiest thing to do is always to leave things the way they are.

So we finally got that done, after much interpersonal conflict and hurt feelings. Now we have the new issue, which seems to be that Deep Freeze doesn't play nicely with Windows updates. In one lab, for example, we have about 60 machines, roughly half belonging to the science division. Their hard disks get reimaged over the weekend by Deep Freeze. But wait, then on Monday morning people walk into the lab and power up all the machines. Now all 60 machines phone home and realize that they need an update from MS; they had the update before, but it got erased by the reimaging. So they all start downloading the same 100 Mb update at once, with predictable effects. A chemistry teacher brings in a whole class to do work on the computers, and the computers are completely unusable. Oops, time to come up with a new lesson plan. Hope he's good at thinking on his feet.

Of course there's no reason in principle that all of these different issues had to be coupled together. E.g., Faronics, which sells Deep Freeze, has another product that only does power management, not reimaging. But the thing is, in real life you're dealing with complex systems and complex human organizations, and lots of well-intentioned changes can have unintended effects.

(...) Windows SteadyState (...) It's available for XP and Vista (32 bit) free from Microsoft(...)

There's also a product that I love: Faronics Deep Freeze.

It takes an image of a system partition upon install and freeze it. Ie. Reload this partition image after every reboot. So you have a fresh computer every day.

Some tweaking necessary - partitionning your disk into a frozen for system, and a non-frozen partition for documents.

It's worth a try, me thinks.

Spyware, adware, viruses and other sh1t? There fixed it for you.

Disclaimer: I am not affiliated with this company in any way. Just a happy customer.

http://www.faronics.com/html/Deepfreeze.asp

Through harsh experience I've found that NO antivirus software is completely securing your computer.

Long story, short: I've lately traveled to Benin, Western Africa, where I've never seen computers so infected in my entire life.

My solution: Faronics Deep Freeze. It will insure your OS integrity by creating an image of it and reapplying this image over and over after every reboot.

I'm a happy user.

Your picture shows Deep Freeze's ability to crash a laptop. It also doesn't mention anywhere that the laptop being shown is running Vista. Deep Freeze may be installed on a store computer to easily remove changes customers make to a laptop while trialing it.

A version of the same idea that is designed to stop malware is Deep Freeze. We use it for a small lab I administer at a school and, in combination with only allowing students to use non-admin accounts, stops malware cold.

- Sam

Have you seen computers at schools? Frankly? There are reasons why schools use products like Deepfreeze.

I just reset the computer and hope they have DeepFreeze or something similar installed, and that the terminal owner isn't him/herself running a keylogger.

When the software gets really bad: SoftICE

Locking down workstations: Deep Freeze

Don't forget to shop at Polar GPS before heading out!

Why not just set up a simply configured Windows system with browsers and apps configured the way you want, and then install an app like DeepFreeze that freezes the setup. The next time they reboot, everything reverts back to its original frozen state. I believe that you can also control just what gets frozen meaning that if you install a second drive (or create a second partition) you can have that data not get frozen so other apps that write data can write to that drive. And for installing apps, just unfreeze, reboot, install, and re-freeze.

Faronics Deep Freeze will allow users complete admin rights from which they can download whatever virii, trojans or other malware they want, experiment to their heart's content with any kind of software or configuration, delete whatever they want. Then, when the system is inevitably fouled up, all they (or you) have to do is push the reset button, and the system reverts to its "frozen" image. A buddy of mine ran a cyber cafe using Deep Freeze. Everybody had admin access to the machines. Needless to say, the young male demographic that such a place attracts had its share of folks bent on malevolence. All he had to do was push reset. Worked every time.

If the problem is the user hosing up the system or the potential for viruses, then you need a product like Centurion Guard DriveShield or Faronic's http://www.faronics.com/ Deep Freeze.

Both basically allow full access to the system but simply delete all changes after a restart.

Most schools, colleges, and public libraries use a product like DriveShield or Deep Freeze to keep their computers running.

Another possible option is WinXP with the Microsoft Shared User Computing Toolkit. A little harder to setup but free.

When I worked at a major U.S. university, we used software called DeepFreeze from http://www.faronics.com/ that did exactly what you think it would do - caused a machine to be "frozen" (meaning no changes could be made) and if anything bad DID happen, a reboot made everything go back to normal. There are administrative options where you can freeze and unfreeze machines remotely (for patch installation, etc), you can "unfreeze" certain parts of the filesystem so files and whatnot can be saved, etc. Might be worth looking in to.

It's pretty handy and not too costly. Also, for our implementation it was great that it was a software solution and not a hardware one, as we didn't want to have to go out and physically touch each of our machines (spread across remote campuses and computer labs, and numbered into the thousands).

-chmod

To be the heritical windows users. Just set the machine up however you like and then install Deepfreeze. Have the machine reboot every night and deepfreeze will reset it back to your saved state. This has the advantage of safely (for you) allowing IE. Thus more websites will work for them, leading to even less work for you. The downside is it will cost you a bit of money.

If you can put some money into it, far and away the best way to do it, you can make it so that certain sections are editable, but upon reboot everything else is back how it was (EVERYTHING)

It seems like the magic bullet you are looking for. Combine it with your preferred flavour of Web Browser and voila: instant idiot proofing

I know I know, every time you build something idiot proof they build a better idiot. But it will be 60 years before those new idiots get to the retirement homes :-)

http://www.faronics.com/
http://en.wikipedia.org/wiki/Deep_Freeze_(software )

Why make this so difficult? Simply use Deep Freeze http://www.faronics.com/ or Clean Slate http://www.fortresgrand.com/products/cls/cls.htm.

When the user is done with the computer, just reboot, and it will be back to its original configuration. If users need a 10MB space or whatever for bookmarks, load them to an internal webpage, or allow that space on a spare computer.

No mess, no fuss, easy.

Disclaimer: I used deep freeze on my grandmother's computer because i grew tired of hearing about broken things every time I visited. That was several years back, and I have not heard a peep since.

My institute of higher learning utilizes Deep Freeze on all computers and restores them all to their original state (except for a 'storage' partition) every weekend. It seems to do the job quite well.

1) Everyone's been waiting for the perfect language that has all the direct power of C but with none of the deficiencies. Let me know when it becomes existant.

2) NT has always had a logical microkernel design. The WDF framework makes common driver types pretty easy to write.

3) NT already uses a single-root namespace for all named objects, not just files. (Unix still has separate namespaces for different object types.) Filesystems are in fact mounted on (and can be unmounted from) logical volume device objects. Win32 is the one with drive letters; e.g. \DosDevices\C: just a symbolic object link to \Device\HarddiskVolume1

4) This would be interesting, although resources other than files aren't too useful across the network. NT has always tended to use RPC for service interfaces that would be useful across the network.

5) Well, Microsoft does have an object oriented LDAP database system now...

6) In NT 3.x, winsrv.dll hosted in csrss.exe in user mode handled all the graphical and windowing stuff. They moved a lot of that to win32k.sys in kernel mode because the marshalling between the server and client processes was complex, difficult to do properly and slow.

7) MFC and now .NET were created for that purpose.

8) NT has always used UCS-2 Unicode exclusively internally. The Win32 ASCII functions all convert to Unicode to call the real function. NT uses the UNICODE_STRING structure internally for all strings, which includes buffer size and data size.

9) This is a good idea. Unfortunately, lot of the code is still in C and C++, which were state of the art at the time and don't work well with garbage collection.

10) This is an interesting idea. When NT was written, Erlang was much too new to be making OS components out of. C with traditional locking continues to work pretty well. Still, I'm betting the next gen operating systems will be in a higher programming language than C, although I'm hoping for Haskell.

11) There exist filter drivers that prevent changes from becoming permanent. Otherwise, this is the same as having a strong mirokernel, which requires ISVs to be more competent than usual.

It wouldn't be helpful to switch to a Unixy core: NT already does all the things that you've described that Unixes also do, plus more things. Win32 is the source of ugliness here, and I too would be happy to see it go into compatibility retirement. There was a time when Longhorn was going to do that.

Maybe you should read up a bit on Mac solutions before you comment- software like Apple Remote Desktop, FileWave, NetOctopus, NetBoot/NetRestore, Radmind, HP OpenView, Deep Freeze and resources like AFP548, Mac Managers, MacOSX Labs, MacEnterprise, and of course Apple itself (I'll leave finding Apple's website as an exercise for the reader ;) make running large Macintosh installations fairly easy. There are plenty of UNIX/CLI tools and scripts out there, and Apple offers professional certifications if you want paper to show a potential employer.

http://www.faronics.com/html/deepfreeze.asp
^^
My high school used that software, anyone could change settings and do basically whatever they wanted, install whatever they wanted.. To undo everything, you just restarted the computer.. You either had to save to a disk, network drive or a partition that retained data when the machine was restarted. The students didn't mind it at all.

... Deep Freeze. http://www.faronics.com/html/deepfreeze.asp

That plus DeepFreeze and AntiExecute (both from Faronics) are used at my school.

Aside from using the admin access controls in windows itself, get DeepFreeze. No matter what is done to the computer, just restart it, and it goes back to the freeze state. Works pretty much every time. http://www.faronics.com/

I worked as an assistant at one of the UW libraries, and we would just put a program called Deep freeze on our computers that froze the boot record, so every time you started it started anew. Then you unfreeze it, make the changes you need to, and go from there. Also inform students that they should save to floppy, USB, whatever.

When I was in scholl they had "Deep Freeze" installed and that worked great at keeping systems clean

Everytime the system is started the image is re-applyed and all programs installed and file not properly saved are removed along with any junk that is there. It a very handy app

"Deep Freeze instantly protects and preserves baseline computer configurations. No matter what changes a user makes to a workstation, simply restart to eradicate all changes and reset the computer to its original state - right down to the last byte."

http://www.faronics.com/html/deepfreeze.asp

They Also have a program called Anti-Executable that is cool too!
http://www.faronics.com/html/AntiExec.asp

When I was in scholl they had "Deep Freeze" installed and that worked great at keeping systems clean

Everytime the system is started the image is re-applyed and all programs installed and file not properly saved are removed along with any junk that is there. It a very handy app

"Deep Freeze instantly protects and preserves baseline computer configurations. No matter what changes a user makes to a workstation, simply restart to eradicate all changes and reset the computer to its original state - right down to the last byte."

http://www.faronics.com/html/deepfreeze.asp

They Also have a program called Anti-Executable that is cool too!
http://www.faronics.com/html/AntiExec.asp

I'm not affiliated with Faronics in any way.

A good solution if you are concerned about generally maintaining the same exact image consistently when people use the machine is to utilize Deep Freeze. In our IT Department at a medium-size University (10,000 students) we use Deep Freeze extensively to keep students from ruining lab computers. Deep Freeze is as others have mentioned, a virtual partition system. Each time you reboot the machine, the original image you had is restored and any changes wiped (only files kept in the "Thawspace" are maintained, all others are lost). This means that no matter what your students do, the machine will be restored on bootup.

Now, if you want to further limit what they can do, you can make many changes to the registry in windows to block users from doing many things such as using the "run" menu, installing applications or a number of other things as simple as changing screen resolution or color depth. Once you set everything up and create the image of your restricted setup, Deep Freeze will maintain it every time for you.

You can get Deep Freeze from here: http://www.faronics.com/ or look there to find out more information about how it works.

We have tried other products in the past that claimed to "restrict" Windows such that users could not make harmful changes (e.g. OnGuard) but none of the ones we utilized were able to be fool-proof and stop students from getting around it or messing something up. Short of reformatting the machine Deep Freeze is pretty hard for the student to get around. Thawing the machine to make changes requires a lengthy key combination to even bring up the password box (key combination is customizeable by you), or you can enter a key combination on bootup to access the password box to thaw the machine. You can also maintain the systems through a Deep Freeze console so you can admin all the machines at once and even push new images to them that way.

That's my three cents on how we do things in an Academic environment, but our general policy has been slight restrictions but allow them a lot of free reign - except we reset the system every time it is rebooted. I'd suggest for Middle and High school to implement a lot more restrictions on the base image that you use with Deep Freeze than what we have here at the University level.

Deep freeze worked well in our labs until we bought enough Ghost Licenses. You set it up on a base configuration, then whatever the little creeps do will be wiped out by a reboot and deep freeze will return the computer to that base configuration. http://www.faronics.com/html/deepfreeze.asp