That's the difference between a secured Unix system and a 'Windows policy editor lockdowned' system.

In windows you just have to close down all ways to do nasty things. End result : undestroyable but also completely useless pc. Nobody can do anything on it.

With a Unix system, students can't mess around anything BUT they can do whatever they want in their personal enviroment and a Unix box is still a usefull tool without root access.