Question : wifi set up in school with two networks

We have a radius server that via AD only allows known MAC addresses to connect to the physical network and two wifi networks.
The students can bring their own laptops in and connect to a guest network with no password and can only connect to the internet on port 80 and 443. VLAN 1.
The secure network has (by memory) something like TKIP encryption. The secure network connects to our shared areas and intranet. VLAN 0 i think ( I didnt set it up).
The problem is that when we issue school laptops to the students , they mess about with the settings and connect to the guest network , the next user cant logon as the AD only authenticates over the secure network. Or they delete the WPA password and i dont dare tell them what it is so I have to logon locally and set it back to the secure netwok.
I only want school laptops  to connect to the secure wifi network only. Is there any scripts I can use?
I have tried disabling icons by the clock, but the students turn the physical wifi switch( on the laptop) on and off, and up pops the wireless config screen... and so they fiddle with the setting.

Answer : wifi set up in school with two networks

sorted out now use script to select the network and insert the wifi key.