The following can be disabled:
- Registry Editor
- Run
- Command Prompt
- PowerShell Prompt
- Management Console
- Run As Admin
- Task Manager
- Control Panel
Note that Local Admin / Domain Admin users can be exempted from this policy, in addition to per PC exemptions.