Thanks both. I've just been looking at my email exchange with A&H after I put it in. Basically they couldn't (wouldn't?) offer anything between password-protected Admin, which was too restrictive, & (unprotected) User, which leaves everything vulnerable. I was hoping someone might have discovered an unofficial work-round. In the meantime it has been, as suggested, a case of keeping out-of-sight copies of the wanted scene. The church users are totally non-technical, & seem incapable of reading even the largest-font Dymo labels about checking they have the right scene loaded, & about powering-down before hitting the wall-switch (or alternatively not leaving the whole system powered-up all week with no ventilation).