Secure Desktop modfies the boot section of the SYSTEM.INI to set the parameters for shell and taskman.exe for replacement. This is a sample of what this section would look like:
[boot]
386grabber=V7VGA.3GR
oemfonts.fon=vgaoem.fon
fixedfon.fon=vgafix.fon
fonts.fon=vgasys.fon
display.drv=WSPDTSF.DRV
shell=vaprgman.exe
network.drv=wfwnet.drv
language.dll=
sound.drv=mmsound.drv
atm.system.drv=system.drv
286grabber=VGACOLOR.2GR
keyboard.drv=D:\MSINPUT\kbd.drv
system.drv=atmsys.drv
SCRNSAVE.EXE=C:\WINDOWS\VASAVER.SCR
oldshell=progman.exe
comm.drv=COMM.DRV
drivers=MMSYSTEM.DLL QKEYS.DRV
taskman.exe=AUTOTASK.EXE
OldTaskMan=TASKSW16.EXE
NoTaskSwitch=False
OldProgMan=progman.exe
This is what happens in Windows 98/ME. In Windows NT4/2000/2003/XP, the registry is modified.