If you have to prevent users from accessing the registry editors,You can use Group Policy. Simply enable the Disable registry editing tools policy setting under your systems'
User Configuration\Administrative Templates\System object.

This setting changes the

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\

registry subkey's DisableRegistry Tools entry (of type REG_DWORD) to a value of 1, which prevents the registry editors from running. (The setting's default value is 0, which permits use of the editors.)

The Windows AIK provides excellent opportunities to create custom Windows PE based images. Those images are provided as WIM files and can be easily converted to ISO files to be burned on CD or DVD. WIM files can also be used to boot from the network using Windows Deployment Services. The Microsoft site also provides procedures to boot a WIM file from USB drive or a clean local hard drive. Unfortunately I was not able to find a complete description how to place a WIM boot image on the local hard disk and provide it as alternative boot option in the Vista boot Menu.

A powerful, free utility called SetACL, written by Helge Klein, can help you; it's available under the GNU General Public License (GPL) at http://www.helge.mynetcologne.de/setacl. SetACL lets you report, modify, back up, and restore permissions, auditing, and ownership for many types of objects, including folders, files, shares, registry keys, printers, and services.