Read the rest for some workarounds to these problems...
First, download these scripts. Put Login.sh and Logout.sh in a place where a non-admin user can't read them (admin doesn't need read access either; I use /private/var/root/Documents/). Use LoginWindow Manager to set these files as login and logout scripts.
Put DeleteUserPrinters.app in /Library/Scripts/Printing Scripts, and make it a login item for your workgroup. Use Dockless to make the AppleScript app invisible to the user (so it doesn't appear in Dock).
Use Apple Remote Desktop to copy out the three scripts and /private -> var -> root -> Library -> Preferences -> com.apple.loginwindow.plist to all of your clients (to enable login and logout script config). Either open ARD with Pseudo to copy out the plist, or enable root then open ARD.
That's it, you should be all set. Please share your results via a comment here or email (click my username for an email link).

