User Group Policy isn't exactly a security mechanism, it exists to prevent users from unintentionally breaking their profile. There is multitude of ways how the

User Group Policy isn't exactly a security mechanism, it exists to prevent users from unintentionally breaking their profile. There is multitude of ways how the user in question can inject arbitrary code into processes that are affected by user group policy as these processes are owned by that user.