The restrictions like cannot go to control panel, cmd, regedit,
no run command in start menu, all these are applied through Group
Policy.
Windows XP Professional.
Or if your school has a technician or TA (Technical Assistant),
these are the fellows who are in-charge of the school
computers.
It is either limited users or power users for students and staff.
Only the technician's and vendor's accounts are part of the
Administrator group.
Guess their passwords, log in to their account and wreak havoc.