>If an application was to enable/disable certain Textboxes in forms depending on Userlevel access in the application, would it be better to include the code in the Textbox REFRESH(), or hold all the code in a central procedure for all forms to access centrally?

I would add the code to your TextBox class, and also add an "lSecured" flag, so you can conditionally turn on or off security.