Scratch

You could also not install Scratch at all and instead let students use it on their own flash drives on your otherwise completely locked down school machine/network...

Another - maybe somewhat academical - question to ponder would be if programming itself is really meant to be safe at all. Or, to put it differently: Shouldn't programming empower you to change your machine?

When I started programming as a kid the first things I did was piping DOS batchfiles for interactive menus and changing the autoexec.bat/config.sys to show the 'main menu' on system launch. I guess, today something like this would be considered a major security breach, even though it was pretty harmless (and even cool) at the time.

The first programming language I experimented with was BASIC (the one that came with DOS), and it allowed me full and easy access to the file system and all peripherals my (dad's) system had. I was able to create/delete files and directories, change the screen's display modes, and send escape-character-sequences to the printer in order to format printed output. I was even able (and allowed) to make the system reboot and load stuff into "resident" memory. If something didn't turn out right I could just reboot from floppies or - later - format the (10 MB) harddisk and reinstall everything. I often wish for today's children to have this kind of unrestrained creative freedom. After all it's actions like these that let you 'master' the machine instead of the other way round.

Just my personal opinion to think about ...

You're right, of course, Paddle2See. Why not let kids play with simple stand-alone machines, then? What's the use of an administrative "school network" in a lab-environment anyway? You've got to be allowed to break things to learn how to fix them, don't you? I like systems which let you change each and everything, like the XO. Why let children in developing countries have all the fun an empowerment? This is something I can get very emotional about: Should we really protect toys from children? (But I'm veering off topic with this...).

My suggestion for maximum security would be to 'lock down' the system with whatever security measures are at hand and to let children use Scratch only from their own private flash drives. That way they might still be able to 'see' drive C: in the file dialogs and perhaps even save a project in some temporary folder there, but other than that no harm whatsoever could be done.