Sorry this post is not Kix-centric. You have a few options.1. Use something like Fortres to lock down the lab (search for another post on this forum).
2. Use local policies, but you already know this one.
3. Customise the .default user hive that everyone inherits.
For option 3 (Don't try this at home!):
Don't know if this will help. Depends how far along you are with deployment. It only works with local profiles and involves blowing away all the profiles (except those you don't want to lock down.
You simply setup a special temporary default user with local admin rights. Logon as that user and set all your preferences, including reg hacks, etc. Backup the existing Default User profile, then logon as administrator and from My Computer | Properties | User Profiles, Copy To... this special user profile to where Default User is.
Now every new user will inherit this 'special' default user. The key word is 'new'. You need to blow away their existing profile. If you have a lot of users drifting through your lab, you probably already do cleanup of the profiles.
Personally, I use a combination of all three options.
