Thanks for all that Harry.
With 2. How about just disabling the mouse and if they hit any key on the keyboard they get it back? I've not yet had a problem with the user being on the keyboard, it's just the mouse. I think they treat it like a TV remote control and just can't give it up sometimes, haha.
With number 3. That might work for me, I didn't realize that was the functionality. I'll have to check that out. Worst case scenario, I can lock the system myself before getting out of it.
I've been using the Unattended Access functionality and didn't notice the botton. I did notice I was asked if I wanted to forward certain keystrokes (like windows key and E) but it didn't forward the ctrl-alt-del.