i'm not too familiar with it, but policy editor(poledit.exe) will let you lock a pc down pretty tight. i think this will prevent the use of explorer. if you only want to allow a user to run certain applications & do nothing else, what you could do is write a VB prog to start these apps. then, edit the system.ini file & replace the "shell = explorer.exe" with the name of your VB prog(e.g. shell = appstart.exe). explorer won't even load & your pre-defined apps are all that runs.