Use any of the thin client/terminal setups to lock down the kids' box. Boot from the server. There's nothing on the client for them to break that can't be fixed by booting from a floppy.
Or, and I like this better now that I think about it: Put some version of Linux on the box and install VMWare on top of it. Cron a daily backup of the file that is their installation. If they hose anything, just copy the backup over the one they broke.
This might take some more memory to maintain performance, and it would definitely take some disk to keep the new "partition." But this is what developers do[1] to isolate the system from the vagaries of development, so I imagine it should be good enough for the kids.
[1] I know Scott used to do this. Don't know if he still does at the new job.