Mac OS X Server (10.2) has a little-used ability to control almost all aspects of the computing experience for its users. But since Server and Client are so similar, the same modifications can work even if you don't have the Server software. You just need to modify NetInfo directly.
Here's an example of how to prevent a user from ejecting a CD.
[Editor's note: Risking a productive iBook, I tested the following hint. When I tried it the first time, I tried it on the Admin account, and it had no effect -- either I made a mistake, or the system is smart enough to not limit the Admin's permissions. When I applied the patch to a non-admin account, however, it worked perfectly. The only problem I had was that, after logging in as Admin again, the eject button didn't work (but dragging to the trash did). A second logout and login cleared that problem.
This hint requires working in NetInfo Manager, through which you can really mess up your system if you're not careful. Before you start changing anything in NetInfo (but after you authenticate), you may want to select Management -> Save Backup to create a new backup file ... just in case! This hint is NOT for beginners; you can do serious damage to your system in NetInfo Manager! With that dire warning out of the way, on to the how-to, which is actually quite cool.]
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>has_mcx_settings</key>
<true/>
<key>simultaneous_login_enabled</key>
<true/>
</dict>
</plist>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>mcx_application_data</key>
<dict>
<key>com.apple.finder</key>
<dict>
<key>Forced</key>
<array>
<dict>
<key>mcx_preference_settings</key>
<dict>
<key>ProhibitBurn</key>
<false/>
<key>ProhibitConnectTo</key>
<false/>
<key>ProhibitEject</key>
<true/>
<key>ProhibitGoToFolder</key>
<false/>
<key>ProhibitGoToiDisk</key>
<false/>
</dict>
</dict>
</array>
</dict>
<key>com.apple.loginwindow</key>
<dict>
<key>Forced</key>
<array>
<dict>
<key>mcx_preference_settings</key>
<dict>
<key>PowerOffDisabledWhileLoggedIn</key>
<false/>
</dict>
</dict>
</array>
</dict>
</dict>
</dict>
</plist>
Mac OS X Hints
http://hints.macworld.com/article.php?story=20021210053604502