Keyloggers in computer labs

[Kay Sommers <ksommers () VCU EDU>]

How are you protecting your computer labs from the installation of
keyloggers?   Lab managers want to use local administrator or power user
accounts on these machines so that various applications run properly,
but of course, that exposes these public machines to the possibility of
anything being installed.  Re-imaging or return point strategies such as
Deep Freeze still leave the machines vulnerable for a certain period of
time.

What approaches are being used to protect public machines other than not
allowing privileged logins?