Restrict access to Windows NT Control Panel applet
Each application (applet) in Control Panel is generated when you open it.
Control Panel opens an applet for each .CPL file it finds in the %systemroot%\system32 folder. You can remove an applet for
everyone by deleting the file (or simply changing the extension to something
other than .CPL). Finer grain control is possible under NTFS by restricting read
access to the particular .CPL file to certain groups.