I had a war going on with one of my customers for about 8 months back in 1996.
They were a high school and they insisted that they needed 2 "Multimedia" machines in the library with CD-ROM's and Soundblaster cards. Running Windows 3.11 with apps like the Microsoft Encarta and its ilk. The rest of the customers network ran on a NetWare environment with BootPROM equipped PC's running Win 3.11 off of the network with locked down and well managed.but we could not use that for the library for a variety of reasons.
It got to the point where I was replacing all of the Windows/DOS configuration files on NetWare login via login script to stop the kids installing games under Windows or DOS and having a "Shutdown" button that removed key Windows and DOS system files on Windows exit so that they could not use the machine outside of the controlled Windows environment.
Worked well but was quite time consuming to install new apps.