I would imagine that you could start with configuring the system the way you want it, then using a product like DeepFreeze or SteadyState, lock down the operating system.

Personally I would create my own launch screen and change the shell from explorer.exe to the custom launch screen.

If the kiosk is public facing, make sure you think through the legal ramifications if guests can access the Internet.

Skype, WebEx, and a few other apps, essentially a guest login, with specific apps available.
I’d need IE/FireFox as well, but stop them from dumping anything else (including new add-ons) into the system without approval.

What’s the best method to go with this?