I think that we understand as there are a number of educational environment admins here.Agree on the need to lock down more, but I've got one word for ya: university. Need I say more...?
I guess you have to allow a certain amount of freedom to some of the student population, but I still think that you should be looking at your workgroup membership and permissions more closely.
Just because some need certain privileges doesn't mean that you have to grant them to all.
I was always taught that one of the fundamental concepts of security is that people only have the permissions and authorities that they need to do their job. No more, no less.
And I am going back way before the days of PCs, LANs and the Internet.