How to restrict activities in Windows?

Question

Access rights

For a long time, in one educational institution, I saw a scheme in which a student has access to Windows 10 with a limited set of actions. He can walk through all folders, run programs, but he cannot install new programs, save files to different folders, and cannot change the desktop. Only the "Documents" folder could be used to write files.
And now I need to implement the same scenario.

Answer 1

This is called software restriction policy.
https://habr.com/ru/post/101971/
Plus banal NTFS rights.
The policy allows you to run applications located in certain directories, for example, in the Windows folder or ProgrammFiles. If the policy is configured, it will not be possible to launch the application from another location, for example, from the desktop. And the user is allowed to write only to the home directory - these are file system rights.

Answer 2

Standard, of course.
In the domain, we simply create a user, set up rights for him (truncated) through groups, and create subsequent such users by copying from the first one.
Small manual: itmu.vsuet.ru/Posobija/AD/htm/2_pr.htm

Answer 3