Another Win2K public setup puzzle

[Julia Schult]

I'm setting up our public workstations in Win2K, and the information from
this list (and to David Merchant an especial thank you) has been quite
helpful.  I do have one puzzle, however, which seems so simple and yet I
can't find the info anywhere.  I'm actually hoping this falls into the
"stupid question" category and that I've missed something obvious.

I'm working with W2K Pro computers on a WinNT server.  We use a single user
account which all the computers log onto automatically on startup.  However,
we allow logoff so that we can then log on in an administrative account to
make changes.  The logoff screen shows a little button called Options>>
which opens out the window to show the domains that are available.  The
difficulty is that it gives the user the idea that they can log onto their
own account on any of the domains shown.

Is there a way to either:
A) limit which logons (including domain logons) can get on to the machine?
Could I just set up the Default User profile to deny access to everything on
the machine?  Or is there a way to prevent everyone but the local
administrator, network administrator account, guest (which I did rename) and
the public user account from logging on in the first place?
or
B) hide the Options button, but still have the capability of logging on to
either the local W2K machine or the one domain we use?

p.s. useful tip for anyone dealing with W2K on public workstations:  I set
up the permissions for the program files for outlook, frontpage, and
netmeeting (conf.exe) to deny all forms of access to all users (including
admins), since these computers are supposed to only be used for Web access.
This in addition to denying Write permission to the public user account for
the whole applications drive (C:).

---Julia E. Schult
Access/Electronic Services Librarian
Elmira College
Jschult at elmira.edu