After doing the above, here is another thing you might consider doing ...
Consider enabling Parental Controls on the student accounts to customize (aka limit) what students may do with the lab Macs. For example, you can completely block access to System Preferences and other applications you don't want students to use.
There's quite a bit of customization possible in Parental Controls.
Of course, to do this each Mac needs to have at least 2 accounts ... an admin account that only you can use + a student (standard user) account. (For ease of management, the account names & passwords could be the same on all the lab Macs. Depends on the overall implementation in your lab.)