That could be a very tough one. One of the services is obviously checking for some registry values and is placing the button there upon finding it. You find when you delete that registry key, the actual service is disabled, which is not what you want - you just want the button placement disabled. In essence, what I think you're getting at is trying to hook the action of placing the button and stop it before it happens. I believe that would require debugging whichever service is in charge of checking for this, finding the routine that is called to check for registry values relating to multiple credential logons, and patching it so it never makes the call the place the button. You could try using Ollydbg or some other debugger and slowly work your way through the windows logon services, but that is going to be a huge feat/pain. I wish you good luck. Maybe someone else can come up with a better answer than that, but that's my understanding at this point based on what you've found so far.