Stop pupils writing to root of C:\
We have our systems formatted as NTFS (took us long enough!!).
One of the things I've noticed is that while pupils can't write to (say) C:\Program Files, or to existing folders in the root of C:\ they ARE able to create their own folder and then write to it.
This is allowing the little bugg - erm - darlings to install portable versions of apps/games to C:\
I'm assuming(!) that there's some easy way to fix this with NTFS and Subinacl, but for the life of me, I can't find it.
Any chance some kind soul can help me out here?