okay, start the command prompt with "run as administrator". then type in mmc.exe to run management console.. File -> add/remove snap-in - add Group Policy Object Editor -> in welcome screen click Browse button -> look at Users-tab and select your "Exclusive User for Media Center".. ok -finish - ok. Now you should see the GPO editor view with left pane having something like Console Root - Local Computer/"MCE-user" - User Configuration. Click your way to User Configuration - Administrative Templates and look around for stuff you want to deny.. Can't remember exact locations of stuff you want, but look in different folders. There's a LOT to deny! You can force old-style start menu without any run-possibility, deny command prompt, deny help to start programs... etc, fool around in there!
edit: System - Ctrl + Alt + Del Options: Remove Task Manager: enabled. Other useful ones to enable are System: Prevent access to regisrty editing tools and the command prompt
