> which involves renaming cmd.exe to the name of the binary that gets run (can't remember the exact name at the moment) when you chose the "Ease of Access" option.

utilman.exe I abused this back in the early days of disclosure