Windows Mobile has, built in, the ability to prevent any application, including the standard internal applications, from executing. You can find published details on http://www.satter.org/2007/03/lets_shell_some.html

"So you want to use the Today screen or a custom Shell over top of the Today screen to create a kiosk device. One of the things you can do is blacklist applications and use what is called lock mode.

First, let us discuss locked mode. When a program is run the Windows Mobile OS does some checks to see if the program is allowed to run. Based on the account being used and security policy the OS may decide

· To run the application without any input from the user. In this case the Windows Mobile OS is unlocked or the application is signed with a valid certificate.

· Prompt the user for what to do. In this case the Windows Mobile OS is in prompt mode and the application is either not signed or signed with a certificate that is not recognized or not valid. If the user says yes the application is run otherwise it is blocked.

· Locked mode is when the Windows Mobile OS is set to not prompt and require a valid certificate. In this case the application must have a valid recognized certificate. In additional all DLLs must be signed as well or the DLLs will not be loaded which may cause the application to fail to load.

The next step is to black list applications. This is actually built into Windows Mobile both Pocket PC and Smartphone editions. To enable this you simply setup a list of programs that are not allowed to run regardless of whether they have valid certificates or in ROM.

You enable this using a value under under the key, HKLM\Security\Policies\Shell. Set the value DisallowRun to 1. Or turn off this feature by setting it to 0.

Under the registry key, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun, you will create a list of values. The values are numbered sequential starting at 1. The value is a string with the name of the executable you wish to block for example

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun]1=clock.exe

In this way the OS will not allow the clock application to be run by the user."......

As a followup, there is a config xml at the previous reference which provides the same (as well as a lot of other options) and may serve as a useful reference.

< wap-provisioningdoc >

< characteristic type = "SecurityPolicy">

< parm name = "4123" value="1" />

< parm name = "4119" value="8" />

< parm name = "4101" value="0" />

< parm name = "4102" value="0" />

< parm name = "4122" value="0" />

< parm name = "2" value="0" />

< parm name = "4120" value="16" />

< parm name = "4103" value="0" />

< parm name = "4097" value="0" />

< characteristic type = "Registry">

< characteristic type = "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun">

< parm name = "1" value="clock.exe" datatype="string" />

< characteristic type = "HKLM\Security\Policies\Shell">

< parm name = "NoRunDlg" value="1" datatype="integer" />

< parm name = "NoAutoRun" value="1" datatype="integer" />

< parm name = "NoExternalExes" value="1" datatype="integer" />

< parm name = "DisallowRun" value="1" datatype="integer" />

characteristic >

Bill,  One solution for this would be to use AppCenter and configure it to disallow the Notes application (\windows\notes.exe) - this will effectively disable the recording facility on the device. Best Regards, Ian Hatton EMb EMEA