Thanks to Experts-Exchange, this is a good solution from jasonzx:
regedit:
navigate to HKLM\Software\Microsoft\WZCSVC
right-click->permissions->select SYSTEM->Advanced->Select System->edit
Deny:Set Value, Create Subkey, create link, delete, write DAC, Write Owner
navigate to HKLM\Software\Microsoft\EAPOL
right-click->permissions->select SYSTEM->Advanced->Select System->edit
Deny:Set Value, Create Subkey, create link, delete, write DAC, Write Owner
To undo, select Deny policy->edit->clear all
Now, this long search is over. No genius students will get on my nerves. They can try, but after all those settings they shall attempt, the computers will not heed their command. Hahahaha!