Back in the day I was an intern at an elementary school, and the computers there had a piece of software installed that basically disallowed any change (unless entering a password by an administrator like myself), and if a change did happen it was undone at a reboot. I'm not sure how it worked or even how it's called, but that's another option. I'm sure it didn't keep browser history either though, although I'm sure there's workarounds for that too.

Just don't give people administrator accounts in Windows, that way they can't / shouldn't be able to install anything, and definitely not something that can permanently change stuff in a computer.