Our solution was to wipe the shortcut folder at every logon & copy back in permitted shortcuts.
It been a while since I worked on this last but I am not sure you can really disable this effectively in Win9x. In practice, we found the biggest problem was saves to desktop from IE.
Note speeking of icons, you are aware students can rename "My Computer" to "My F***ing Computer"? This can be refreshed every logon through the registry.
_________________________
Jack
