What you may consider instead, is killing the process "explorer.exe". Then do a findwindow and look for taskmanager... if you see task manager, send a wm_close message (so they can't just open task manager, and run explorer.exe again). With explorer.exe gone... they have access to nothing but taskman... just a thought.