>How do you do that (locking up the HKEY_CLASSES_ROOT), and why would it p~~s off everybody?

You can restrict what privileges a user has on portions of the registry by userid under NT and Win2K on a user basis; I believe that similar restrictions can be enforced under Win9x through user profiles and system policies.

Disallowing writes to the HKEY_CLASSES_ROOT hive would prevent the user from creating new file associations and adding COM/ActiveX objects to the system; many applications would not be able to install, web pages that sent ActiveX controls or script components would not be able to add them, etc. If you can't read HKEY_CLASSES_ROOT, no OLE/COM/ActiveX functionality is available; the entire OS breaks, since key elements of the OS rely on COM and OLE information contained in this section of the registry.