Each machine must have at least one account with admin rights. As IT/admin, you log on and can create user accounts with various levels of authority. So create a generic user profile or one per student, and only give them that user name and password.
Where I was we gave everybody local admin rights. But then the machines were re-imaged over the network between classes.