You'd want to use Group Policies in a Domain if you didn't want them to apply to yourself on that computer and just the user. But if you don't have a domain, you could disable the run and still browse to your gpedit.msc it's in c:\windows\system32 if I'm not mistaken.
You wouldn't be able to just quickly change the wallpaper or run line until you disabled the policy again, that's the whole idea. :)
If you know the user, and can get them to login (or use a login script to check if %username% = victim) then you could apply this registry key (and others that do similar things like disable wallpaper changing)
Disable the run line (without policy)
By changing the key in HKLU (local user) and not HKLM (local machine) you are hitting just your user and nobody else.
Again, using a domain and full featured GPO is much cleaner, but if you are in some workgroup setting than a reg key might be a good idea until they realize they can login as another user... :)