Some time ago, when I was working at a place as a tech, they used a enterprise licensed program called "deepfreeze"
It encrypts the OS and does a bunch of other stuff, we could make it so any client for your network will boot up the same time everytime, no matter what kind of crazy stuff is done to it. Alot of people did some not so smart things.
Not a cheap solution I imagine, I don't really know but for a smaller/medium company might not be all that bad (no idea on the cost), might be worth it if this kind of thing is a big enough problem.