Task Manager security bug

I don't know if this exists only in Embedded or in Pro as well -- I suppose
both, but I don't have an XP Pro with the right configuration to check it
out (all I can get at are domain members, need a standalone).

It's only possible on machines that are not members of a domain and have
"fast user switching" enabled, so the "Users" tab exists in task manager.

* disable the "Run" function of the start menu (through gpedit.msc or
directly in the registry). This disables the "New Task" button in task
manager as well - or at least it should.

* open task manager, Applications tab -> the button is grayed out as
expected

* you can verify that there is no "New Task" item in the File menu while
you're on the Applications, Processes or Performance tabs

* go to the "Users" tab: menu File -> New Task is there and it works.



It's becoming a problem with devices that were supposed to be running a
custom shell and nothing but that shell, and that now suddenly appear to
contain a functional web browser.

Task manager was included with the "new task" button disabled because I
thought it could be handy as a diagnostic tool to get a look at the process
and performance tabs. It turns out to be a lot more than that