I am going to try an answer this.
The pointers to these icons are held in the registry actually
However, there is a folder that can only be accessed by a shortcut...
%windir%\explorer.exe shell:::{4234d49b-0245-4df3-b780-3893943456e1}
Create a new shortcut on your desktop with that as the path.
Then change to details view
Then hold left click on the scroll bar and you will see part of the path....
The actual path is...
HKEY_CURRENT_USER\Software\Classes\Extensions\Contractld\Windows.Protocol\Packageld
They appear to be classified as URL's to a lot of the Default Apps. Not all are though
However,
The apps are actually held in
C:\Program Files\WindowsApps
C:\ProgramData\Microsoft\Windows\AppRepository
C:\Users\??????\AppData\Local\Packages
DO NOT TAKE OWNERSHIP of that location, you will hose your system and have to reload, no a refresh will not fix it.
You can fix the apps by uninstalling and reinstalling them, but there are other issues that it causes. so, my advice, don't do it.
I found this info and it might help in understanding a bit more...
WinRT/Metro Style App Data | One Dev Job
Application Manifests and a database of installed applications
%ProgramData%\Microsoft\Windows\AppRepository
e.g.
c:\ProgramData\Microsoft\Windows\AppRepository\89006A2E.SketchBookExpress_1.0.0.2013_x64__tf1gferkr813w.xml
Application code and content/resource files
%ProgramFiles%\WindowsApps
e.g.
c:\Program Files\WindowsApps\89006A2E.SketchBookExpress_1.0.0.2013_x64__tf1gferkr813w\SketchBook.exe
c:\Program Files\WindowsApps\89006A2E.SketchBookExpress_1.0.0.2013_x64__tf1gferkr813w\AboutPage.xaml
Application settings and data storage (settings, saved documents, web cache, temporary data storage)
%LOCALAPPDATA%\Packages
e.g.
c:\Users\Filip\AppData\Local\Packages\89006A2E.SketchBookExpress_tf1gferkr813w\Settings\settings.dat
c:\Users\Filip\AppData\Local\Packages\89006A2E.SketchBookExpress_tf1gferkr813w\LocalState\SketchBook.tiff
c:\Users\Filip\AppData\Local\Packages\WinStore_cw5n1h2txyewy\AC\INetCookies\IY2KIDUJ.txt
c:\Users\Filip\AppData\Local\Packages\WinStore_cw5n1h2txyewy\AC\INetCacheY7EQF5Z\Frame[1].htm
I have not tried setting permissions on the Registry Keys (haven't needed to) to see if that can stop someone from at least uninstalling anything. Maybe?
However, I do not have time now, but what Coke Robot suggested is a good one.
DeepFreeze is one that I have looked at a long time ago
I hope some of this helps with why you can't lockdown these settings.
I am still hunting for some lockdown settings for Win8, it can be useful.