That's basically correct, with one correction. In order to avoid that last problem you mentioned, I run an entire form or parent container through an algorithm that specifies certain exceptions (Lock all controls except A, B, and C). The algorithm takes the entire tree or subtree of controls, and inserts those locked panels wherever needed such that they cover all controls except the ones listed as exceptions. So if control X has children A, B, and C, and we don't want to lock up B, it would leave X alone and lock up A and C separately. This of course assumes that container controls don't themselves need to be locked, so it's not quite foolproof.