How do you monitor that a user doesn't add himself to the administrators group permanently?

Also, how do you ensure that the user is removed correctly upon logoff or in case the computer crashes/looses power/is switched off without a logoff script running?

Anyway, it's definitely doable.
_________________________
There are two types of vessels, submarines and targets.