Each application (applet) in Control Panel is generated when you open it. Control Panel opens an applet for each .CPL file it finds in the %systemroot%\system32 folder. You can remove an applet for everyone by deleting the file (or simply changing the extension to something other than .CPL). Finer grain control is possible under NTFS by restricting read access to the particular .CPL file to certain groups.