[Web4lib] Protecting public computers

[Judy McBrian]

Please excuse the cross posting
Sigh.
 I'll try to make this brief...
 I'm sys idiot for a medium sized library.  We have 3 remote branches 
with from 2-4 computers for the public.
At one branch I go weekly and attend to them since the lady in change 
has no real clue about computers.
At the other I allowed the person in charge to go into "exec" so that 
she can do MS and virus updates.
Two machines at this branch are old (but bullet-proof) Gates with 
Centurion Guard.  The others are newish XP pros
that have the patron profile as limited, and the exec as allowed. 
(Passworded natch)  We also use Clean
Slate which blocks as the default in the public profile.

It seems that someone either found out the exec password or the computer 
was left in an unprotected state
since all of the MS Office files are gone, the computer had 3 virus, and 
the other machine had a ton
of cookies on it that Clean Slate, etc should not have allowed.
The horse is out of the barn, but now I would like to call on all of you 
who are much better at this than I am
it seems. 
I need to make changes. 
1. I could travel the 12 or so miles once a week like I do to the other 
branch and do it myself.  They are open 3 days a week
but I doubt that I could manage that kind of schedule
2. I could try installing Centurion Guard in addition to Clean Slate 
which by the way, works great here at the main
branch and is not as much as a resource hog as DeepFreeze.
3. I could switch out the newer machines, leaving them in the main 
library under my tender care and take
a couple of old Gates units to the branch.  Thus leaving the branch 
person with the responsibility of  remembering to lock it up.
4. I could kill the branch librarian, but that might have legal 
repercussions

If any of you have deep thoughts on this, or ANY other suggestions I 
would be very happy.

Thank you so much
Judy McBrian
Boonville Warrick County Public Library