I like Lons' answer. I'm gonna keep that one in my neat tricks folder. I've been trying to find a way to write HKLM from logon scripts for a while now.

We are also hiding drives on the workstation.

The easiest way of enforcing NoDrives in a homogenous NT environment is by using standard Windows NT policy. Microsoft already has a policy editor template for hiding all drives (common.adm). We then customized it to hide/expose any drive we want.