If you disable it in Device Manager, can't you restrict ordanary users from accessing it? Also, how about hardware profiles, you could have that user's profile with the CD-RW disabled. Finally, Group Policies is probably the easiest way to kill it off.