Heh, my "backdoor" was clicking a broken shortcut in the program files menu, because it prompted you to browse for the executable. Browse to cmd.exe and you're good to go.
In fifth grade, our Windows 2000 box was "locked down" so that all you could do was print documents. Turns out, however, that the printer control interface reachable from the print dialog had a "Select PostScript interpreter" button which would launch the specified executable whenever a page was printed.
