Group Policy issues - windows 10 roll out

[gaz003]

I am trying to setup Windows 10 for a possible summer roll out. I have managed to lock down quite a lot of new settings but I am having problems with the following:

 

I want to stop students accessing the windows administration tools menu

they can load services, defrag application (although not do anything) along with the other admin tools apps

 

Can I stop them loading this full stop?,

 

any help is massively appreciated. I have had a look at the app locker but when I disable this for students it doesn't seem to work