Sir Dice said:

Domain policies, third party software and what not are all moot if I can boot the machine with a live-cd...
That really hits the nail on the head! the actual issue is more like "How do I stop users running unauthorised executables in my environment" rather that "how do I stop them running batch files"

JonnyFrond
Wow Nihil, I had no idea, which James Bond film were you in??
It isn't funny mate. Given that this sort of thing is rife in secondary schools, vocational colleges and universities, you have to assume that people you hire these days will have the knowledge and skill to pull it off....................even if they couldn't write a batch file to save their miserable lives

As for the boot sequence, you can use a custom BIOS and/or an EEPROM chip, and put a lock on the case.................mess with that and you are out................instantly.............as I have said, a strong AUP is part of the model.

Also, why pay for CD/DVD drives, USB, floppy drives if you don't NEED them.