We use main profile (or mandatory) for teachers (with passwords of course) and the system admin and roaming profiles for students. Soometimes they need to install software that is why we allow it for roaming frofiles, but need to track what they install: whether they need it for studying or playing games (that happens sometimes).