Just a note about how we deal with laptops at our school..
we have several laptop trollies where the students logon to the network with restricted desktops - this is now working fine technically (we have a wireless controller set using VLANs) - although, inevitably we have the 'keys falling off' scenario and a couple of broken screens. We have learnt to manage this by checking the trollies and laptops on a fortnightly basis for ANY damage - this is then recorded and any damages since last time are highlighted. It is very much down to the teachers concerned to manage the laptops and they get hassle from the SMT when things go wrong.
We have now added another VLAN to separate 'guest' users to give them temporary access to the internet. We have also set up a group for students and teachers to use this entry too. This means that they can access their school work via the VLE without having to go via the school network.
This VLAN uses a separate IP range so is in effect a VPN, but it does still have the filtered net so our students are 'safe'. No doubt we'll still have the access problems, but hopefully not too many, and also we don't have to get too hung up about anti-virus stuff.
There's still a lot of hassles no doubt, but hopefully we are trying to work with the SMT (!!!) to both move in the right direction.