Do they need to actually change network settings at all? Would denying their ability to alter network config completely defeat the purpose? Thats easy enough to do. Shall google in in a bit and edit this post
Block all of control panel [url=]http://www.computerperformance.co.uk/w2k3/gp/group_policy_control_panel.htm#Control Panel (Root)[/url]
Block specific control panel applets
http://support.microsoft.com/kb/325852
Either of these could be enforced with a group policy done at logon
There are ways to hide individual tabs in the options but that starts to get a bit more complicated

Edit: What age/year-level of students are we dealing with? Sometimes, the punishment for breach of ICT policy/user-agreement use is the best way to stop it, at least what I've found in birth-yr12(age16-7). College/University would be far different, but steps to lock stuff down the same.
Providing the supplied settings are the only one to be used: Block off access to Control Panel, cmd & MMC for students as a group. I don't recall where they are off hand in GP, but I do it for the students I deal with to stop 99% of them changing such settings.
You might want to consider locking down exe&bat files to some extent as well, at least one will consider bringing them in on a USB drive at some point that changes this.
I've got better notes at work, so I'll have a hunt around at what is set on our servers tomorrow. Can't remote in right now unfortunately thanks to decisions made higher up.

You can definitely set restrictions on network access / what protocols to allow and disallow using certificates, but in this case it's probably best to follow Ois' suggestion and just block access to the control panel, registry, and console so the sniggering l33th4x0r twats can't change anything.

Sorry I have no answer for you.
But I can't stop laughing. You sir have a way with words that's rare. I can perfectly understand the feelings you're having and your situation and you paint a picture with words that have, well a lot of humour in it.
Sorry again. Might just be me having a warped sense of humour.

Aye, shall try what Ois said. Thanks for the help. Will need to test it a bit, to see how it works, as I just noticed some previous attempt at it, that did not work.
EDIT:
@Tarm
Hehe, thanks. When I'm feeling pissed, extremely bored or nostalgic, I tend to get creative with words.

Blocking the control panel entirely will stop them changing mouse settings and other things they should have the access to use for general useability though, its sort of overkill

Possibly, but we'll see how it goes. I noticed settings for blocking or allowing certain options in the control panel, which might work as a compromise.
High school students (16-19). The laptops in question are owned by the school, and are loaned out as they're needed. I dunno if this is put in the user-agreement, but it should probably be. I'm only a trainee here, working on a specialized high school diploma thingy (two years of school, two years of working practice), so there are certain aspects I've got low control over, but I'll check it out and come with certain suggestions, methinks.

Are you running a standard operating environment? I made one of those once where it was so locked down that the users only had access to the specific things they need and absolutely nothing else. Might be a plan to make something more restrictive

Laptop loans: we're heading in this direction next year. I've got some 100 laptops coming in the next few months. Still planning drafts of any special clauses we need for them, aside from the obvious not trying to 'borrow' them to sell at the local shops. :)
----
I believe you can leave access to the mouse and accessibility (among others) in the control panel. Printers is another one you may want to consider just for the occasional convenience.

Yeah thats the thing I linked to in my first post, hiding any control panel applets that aren't specifically required for user comfort (mouse, display and maybe stuff like language options) and making sure that users can't break shit is good network admin policy

Ahhh, sorry I missed your edit.
Absolutely.

I messed around a bit, and tested some stuff. I was able to completely block the control panel without problems, and every little bit of setting. Apart from that fucking tray icon, which they can access to change the wireless network regardless of these settings.
The very core of my being is yearning for a lead pipe, and skulls of those neurologically decayed morons who developed this half-ton of putrid code bile. Oh, well. Time for lunch.

Sounds like you need to stop the controller running and use the windows zero configuration util. From my experience, that works with most anything other than dlink cards