I don't like policies. I tested roaming, mandatory, local, & group. All are flawed in my opinion. MS designed their security for a business environment not a school. The closer you are to the one official user to one machine the better MS security works. Large numbers of users randomly accessing different machines with different capabilities is not something Ms handles well. To do well with MS security you must fit one of 2 molds - all machines are exactly the same & all potentially have access to the same software or you must be a business environment where each user has their own machine.

Locking down the desktop in a school is hard. Students are very creative. We moved to disabling policies entirely. We do all security with reg files. We restore the machine images with PCRdist.

I presume you have problems with your wallpaper, screensaver, renaming of system icons, deleting icons, etc. The only real answer is reset these things on every logon. Too many MS apps offer backdoors that circumvent your best security. You need to disable the search & Windows keys. You really must also limit the apps student can run. Too many can get to explorer or telnet or whatever.