WOW! Both answers are spot on. For new images I will use the Access method, but the shmgrate.exe methopd allows me to push that policy to existing users. Any thoughts on what registry settings the access method tickles? Strangely enough for some users I need to be able to block access to IE but for others they'll get it but only through a shortcut applied through a GPO setting the homepage, favourites etc. Much appreciate the fast replies, you've saved me a lot of work. Thanks JWT