Ohoooooh yeah!
I come from the Engineering industry High Tech dedicated trusted boffins mostly with fuill admin rights..... now working in a call centre and Group Policy:
User Configuration (Enabled)
Folder Redirectionhide
Desktophide
Setting: Basic (Redirect everyone's folder to the same location)hide
Path: \\SERVER.DOMAIN.net\SHAREDLOCATION$\TEACHERS\Desktop
This controls what appears on the desktop, IE, Word, short cuts to mapped drives etc. Lock this down via NTFS permissions ie read only.
Start Menuhide
Setting: Basic (Redirect everyone's folder to the same location)hide
Path: \\SERVER001.DOMAIN.net\pc_config$\TEACERS\Start_Menu
Optionshide
This controls what appears on the Start Menu, IE, Word etc. Lock this down via NTFS permissions ie read only.
This complimented with the lock down i.e no access tio browse the PC / run commands etc this will give you a robust system.
The use your AD goups to link these GPO's to.
But test test test before deploying something like this.
Hope this gives you as start point.
Iain