Two things to consider here:
First… Where would the Windows 2000 system be connecting to? (Yeah, I ended a question with a preposition) Do you want the kids to have Internet access from a tutoring system? Are you intending for them to get access to courseware of some sort through the Win 2000 system? or from the Internet?
You’ve described a physical layout without describing the objective of the connection. Unless there’s a specific reason for this tutoring network to go anywhere, I’d recommend that it just stand alone. The most effective firewall is a connection that leads nowhere.
Secondly, I’d make a couple of really serious recommendations for the student workstations:
– Build a “master” O/S sample on a machine which students do NOT have access to
– Get an external hard drive of some sort. Type doesn’t matter as long as it’s got enough capacity to contain a complete “ghost” image of the basic O/S, applications, whatever’s on the system, since I know from experience that some bright kid is going to sabotage one or more of them at some point.
– Go to www.cisecurity.org (Center for Internet Security) and get their benchmark tool (free) to lock down the configuration of your master system (The one from which the ghost image will be built).
– Consider using tweakui to further lock down the desktop. This tool is available at http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx (NOTE: There are multiple versions of tweakui and they do NOT interoperate well among various O/S versions).
– Then “ghost” the created, secured image on to each student machine. That way if/when disaster strikes, all you have to do is “re-ghost” the target machine from your off-line master, change the name back to a unique one, and you’re back in business.
– From time to time, apply your patches to the master configuration, re-create the ghost image, and re-ghost the machines. That way, they STAY all in sync. Kinko’s, for example, re-images all their rental machines every night. You probably don’t need to go to that extreme, but that shows the value of being able to keep your machines clean.
This might sound like a lot of up-front work, but it will save you endless hours when something goes wrong.