One other trick when the administrator had locked down the Registry Editor was to use the EDIT.COM program to modify REGEDIT.EXE and corrupt the "DisableRegistryTools" string, and save it in some directory you have write access to. Then it wouldn't read the value keyed by that string in the registry. If I remember correctly you'd have to open EDIT with a command line parameter that enabled binary mode, something like "/78".
Sometimes the Run box and the Command Prompt were locked down too, to get around that you could navigate to C:\WINDOWS\SYSTEM32 in Explorer and run FTP.EXE, then use the "!" command to run whatever other commands you needed.
If Microsoft Office was installed, another easy way to run whatever you wanted despite lockdown settings was to open Excel or Word and go to the VBA (Visual Basic for Applications) window with Alt+F11, and use the Shell() function from the Immediate pane.
Exactly, EDIT.COM from Win9x had an incredibly useful binary mode (EDIT /xx filename), where xx is the number of columns to display. I'm really missing it in modern windows... it's very useful to sometimes quickly binary patch a file from a terminal.
Sometimes the Run box and the Command Prompt were locked down too, to get around that you could navigate to C:\WINDOWS\SYSTEM32 in Explorer and run FTP.EXE, then use the "!" command to run whatever other commands you needed.
If Microsoft Office was installed, another easy way to run whatever you wanted despite lockdown settings was to open Excel or Word and go to the VBA (Visual Basic for Applications) window with Alt+F11, and use the Shell() function from the Immediate pane.