Vista - Protecting System from Library Patrons

Hello!

I work at a small public library where I recently purchased some very awesome computers with Windows Vista Ultimate x64 as part of a grant (since last time the library's seen a grant like this was 10 years ago, I wanted to do my best to get systems that would hopefully not age terribly fast and would last 10+ years).

I was hoping to use SteadyState to protect the computers from the public library users for whom they were purchased, but failed to notice the dreaded 32-bit ONLY part of the specifications (I know, I have no idea how I missed it). As a result, I didn't leave room in the budget to purchase software such as Deep Freeze to protect the machine. If I have to buy Deep Freeze, then I have to buy it, but I'm not convinced it is necessary. However, I am something of a newb in regards to setting up user groups and access permissions.

In a public workstation for a library, what we are looking for is a user account that:

allows patrons to burn discs
allows patrons to access USB flash drives and other removeable media
allows patrons to download files
does not allow patrons to install programs
does not allow patrons to modify settings
does not allow patrons to access all programs
deletes all user activity on log-off for privacy reasons (removes browser surfing history, clears passwords even if the patron accidentally told the browser to save them, deletes files save to the computer etc...)

Does anyone have a recommendation for me? If I have to buy a program, I'll just have to suck it up and buy it, but I want to make sure I am doing the right thing. I also have no problem setting up user groups or some such thing as long as I am provided clear and simple direction (for which I would be most grateful!). It is just something I do not have much experience in myself, but I am very willing to learn.

I appreciate any input you may have.

Hi GFLManager,

Vista already has some useful programs built-in to help you achieve what you want to do. You can use 'Parental Controls' to enforce your system availability times, and you can use 'Group Policy' to actually enforce what you allow and don't allow your users to do whilst on the machine.
For details on 'Group Policy', see the following book:

Windows Group Policy Resource Kit: Windows Server 2008 and Windows Vista
Microsoft Press
ISBN-13: 978-0-7356-2514-3
ISBN-10: 0-7356-2514-X

Also, have a look at this link: group policy vista - Microsoft TechNet Search

In addition, you might find some of the books that I use informative and useful: Reference Material