Control iTunes in Workgroup manager

[yandso]

I am in a school environment and would like to manage the students iTunes usage. I have figured out how to restrict the radio and other features, using the workgroup manager and groups, however when a student logs in the default state of iTunes parental controls is unlocked. I have not been able to figure out how to set the default state to be locked.