The most secure boot drive against mesing with that i have heard of is a fellow had a specific server located in a shared corporate server computer room. All the 'smart' techies from the other corporate areas thought it was fun hacking everyone else's servers and resetting passwords etc. Luckily they left the system and the operations alone but just made life difficult for the other techs.
On my advice my mate updated and old antivirus trick.
He set the operating system to boot off drive 'C a very small hard drive with only the operating system on it (absolute minimum size 600MB). Thjen everything else was loaded on to drive 'D'. The administrator password file was on drive 'C' all other passwords are on drive 'D'.
Once everything was set up he burnt a copy of the 'C' drive to a CD. Installed a CD player as drive 'C'. The CD player was set so that you ahd to pull the box apart to get at it and the case had a quality case lock. the machine is set with a BIOS password so they cant get in a change it either. Floppy disabled too.
Nothing anyone can do will change the set up operating system or the admin password.