There may be better ways, but you could test giving not giving them full or
modify permissions on their desktop folder in their profile. I know there
are some settings in Group Policy users configurarion somewhere for desktop
also, but I am not sure if you can accomplish that with Group Policy. The
deployment_setup newsgroup folks may have some ideas also.--- Steve