JSI Tip 0160 - How can I prevent users from accessing Control Panel / System?

Remove the Read permission from %SystemRoot%\System32\Sysdm.cpl for the Group(s) / User(s) that you wish to restrict.

You can get at list of Control Panel Applets by typing:

dir %SystemRoot%\System32\*.cpl /b

To remove all Control Panel Objects, see Locking down that desktop at tip 050.