I agree entirely about child training procedures, and if I was a parent with total control I would do exactly that, but in certain post-divorce situations, with a certain type of teenage child determined to play one off against the other, etc, etc, one sometimes has to put the fire out without being able to do much about the next one starting a few days later.
I don't know of a good solution. A desktop PC, used by others, can to a large degree be locked down, and how to do this is a whole big subject on which reams have been written.
But a laptop is going to get trashed eventually, because children are inquisitive and the internet is full of hazards, especially on the sorts of websites (game cracks/cheats) which they tend to go to.
One can do certain things on the home router, assuming the said laptop is accessing the internet via a wifi router. For example, I limit my 13 year old to internet access via a wifi connection which is set up purely for him, and that lets through only ports 80, 443 and I think 65 (DNS). Unfortunately, most malware is still downloaded via plain HTTP (port 80)... It does stop him running P2P software though. One can also implement timed access that way (e.g. shutting off 11pm).