Prevent users from editing menu/desktop shortcuts. (bugs?)

[nuser]

  The session settings are not locked. The kioskrc is configured to not allow anyone to change session saving/loading settings, but file access times (~/.config xfce4-session.rc X /etc/xdg xfce4-session.rc) show that even when "~/.config xfce4-session.rc" gets deleted, when user logs out (not saving session) it gets created again, then this same user logs in, his sessionrc gets accessed, but system sessionrc gets not. I guess kiosk mode for session handling is not working properly here. If anyone is getting it to work please tell, and your xfce version.
 Another problem that is happening (dont know if its related, but happened after that), every /new/ user on the system is not able to shutdown the machine.
 If it's just with me, I'll report that to the XFCE Debian testing packaging team!
 
ii  xfce4                    4.3.90.1-2
ii  xfce4-mcs-manager        4.3.90.1-3
ii  xfce4-mcs-plugins        4.3.90.1-1 
ii  xfce4-panel              4.3.90.1-3
ii  xfce4-session            4.3.90.1-1
-----
[xfce4-panel]
CustomizePanel=NONE
[xfce4-session]
CustomizeSplash=NONE
CustomizeChooser=NONE
CustomizeLogout=NONE
CustomizeCompatibility=NONE
CustomizeSecurity=NONE
Shutdown=ALL
[xfdesktop]
UserMenu=NONE
CustomizeBackdrop=student
CustomizeDesktopMenu=NONE
CustomizeWindowlist=NONE
CustomizeDesktopIcons=NONE
-----

  bye
 
>  I'm using XFCE 4.3.90.1, the options you pointed are not present on /usr/share/doc/xfdesktop4 (debian etch docs for this package, and I guess not on the original source tarball since debian packaging steps almost always copy this kind of file from the source tarball) neither on 
> http://www.xfce.org/documentation/docs-4.2/ (http://www.xfce.org/documentation/docs-4.2/xfdesktop.html). I tried them, and they worked, thank you.
>  But I had some problems, all users were able to change splash, even when I told NONE or root to kioskrc; The same happened with logout options, the chooser (session chooser settings), and compatibility; Unfortunally, when users were not with the right to change these last 3, and they did, they were not able to shutdown, even with ALL, or their logins specified on the kioskrc "Shutdown" option. I tried everything, deleted their home, purged (remove package and conf files/dirs) xfce4 (everything). Now just the users the were already on the system can shutdown, I removed /etc/xdg/xfce4/kiosk dir, because it did not exist, added some users, did not change any setting, even so, not able to shutdown the machine. These new users and those that are able to shutdown have the same system privileges (even copied old user home to new user home). 
>  On production machines I'll forbid users to change menus, desktop icons, panel, and hope they will not try to change logout and session settings, so this wont happen again. Maybe I´ll remove the shortcut to the mcs-manager.
> 
> These are the current settings
> ---- /etc/xdg/xfce4/kiosk/kioskrc
> [xfce4-panel]
> CustomizePanel=NONE
> [xfce4-session]
> CustomizeSplash=NONE
> CustomizeChooser=ALL
> CustomizeLogout=ALL
> CustomizeCompatibility=ALL
> CustomizeSecurity=NONE --> (also tried ALL)
> Shutdown=ALL
> [xfdesktop]
> UserMenu=NONE
> CustomizeBackdrop=NONE
> CustomizeDesktopMenu=NONE
> CustomizeWindowlist=NONE
> CustomizeDesktopIcons=NONE
> ----
> 
> > nuser wrote:
> > > 
> > >  Is there a "kiosk" way to prevent menu editing at least? Or some other not so polite way (I' dont want to chattr +i on the menu files).
> > 
> > http://svn.xfce.org/svn/xfce/xfdesktop/trunk/doc/README.kiosk
> > 
> > 	-brian