As an extra step for public-access computers, including public computer kiosks, and computers in classrooms, labs, and libraries, Stanford University recommends installing a product called Deep Freeze.
When Deep Freeze is installed, every time that computer is restarted, the system boots up with a "pristine system.” All system changes, software installations, and saved files are permanently deleted after each restart. All systems are configured to restart automatically once a day, and also after a set specified amount of idle time.
Deep Freeze makes it possible for IT Support groups to grant students unrestricted access to university-owned computers in classroom and research areas, while at the same time making sure that any changes made to those systems through regular use (configuration changes, accidental installation of spyware and viruses, installation of unauthorized software, etc.) do not accumulate and render the machine unusable. It also erases all traces of the previous user, reducing the likelihood that personal information will remain on the machine where it can be viewed by other users.
Deep Freeze prevents users from storing files on the local hard disk of those computers — so it's important to remind users that any files that do need saving should be saved somewhere besides the computer's hard disk (encrypted external drive, Stanford Medicine Box, etc.).