Group Policy or NTFS to lock down school labs

As far as I know, there aren't any specific resources focused on lab security. A lot of the work you'll have to do depends on whether or not the lab is open to the Internet. If it is, you should treat each lab machine as a potential security threat. The books I like the most on this subject are both titled "Windows 2000 Security Handbook." One is by Phil Cox and Tom Sheldon from Osborne/McGraw Hill and the other is by Jeff Schmidt from Que.

I'd take a look at the security templates and get familiar with the Security Configuration Editor. The "SecureWS" template gives you a pretty good start at locking down a desktop. You might also want to take a look at the website for the SANS (Systems Administration, Networking, and Security) Institute. These folks specialize in network and PC security. They have conferences in all parts of the country where you can trade information with fellow administrators and attend presentations from security professionals.