You can lock up windows to where all a user can do is shut the computer down. Group policy, etc.

When our company used conference room PCs (instead of room systems) we had a program that would reboot them nightly to reload the known good image. I suppose some risk of file recovery was present, but this was also a half-way decent approach as long as the machine wasn't deeply compromised (bios level or something).