> Why can't MS provide the lockout via a registry setting or something -- is >that also too easy for viri to exploit?

You can change registry entries with WSH, so it wouldn't do much to solve the problem.