I have a problem with people having illegal access to lab computers bypassing strong password protections.
Several computers at my VLSI labs at college have Windows 7 HE installed. Some are dual-booting machines with Fedora or Ubuntu installed. All Windows machines have user accounts by department, while the Fedora/Ubuntu ones are open to all. All machines are connected at time to a local LAN, and have internet access.
Recently, I have found that some people are accessing the admin accounts and making unauthorized changes/downloads/installs. Some basic research suggested chntpw is probably to blame. The admin looked at logs and found some of the culprits - but it's always retrospective action.
I also found some enterprising people using Live CDs and replacing the Utilman.exe with cmd.exe, gaining root access during login and replacing the admin password using the net user command.
Most (but not all) perpetrators are being caught, but only after the damage is done.
My question is how do I stop these people, without removing either OS, banning physical media or starting body searches ?
Preventive measures would be best. Although I would take real-time detection, if possible, as well.