cant you disable run with a GPO too? (you should)
most of the security shouldnt be handled that way anyway (what if run can be accessed another way, that you are unaware of?)