Random appearence of administrative tools on start menu

For some reason, and on random user accounts, pupils are getting access to the local system administrative tools (computer management, dotnet config etc.) through the start menu. It's not one year/one group of pupils, but random ones. We redirect our start menus using GPOs with different ones for staff vs pupils etc. As they don't have admin rights, they can't do much appart from use net send etc, but i would rather close this hole up. Does anyone have any ideas?

Use GPO to change the security permission on the Administrative Tools folder in the All User start menu so they can't get into it?

Startup script to do the same, or even delete the folder from the all user start menu? If you've got access to Control Panel you don't need it.

They don't have access to the CP, but I as an admin do, so I think I may have to add that line in to the login script.