I'll start:
Configuring the system in such a way that the user cannot update the kernel via the terminal (
sudo apt-get dist-upgrade
). This is unnecessarily restrictive, IMO. If the user goes out of their way to open up a terminal and enter in commands as an alternative for what a GUI offers, they should be allowed to do so.This is what I've observed in Linux Mint 18.3 with Cinnamon, but if this has changed in recent versions, then yay.