I do not know what I have done wrong, but I cannot get the KDE Action Restrictions to work.
I logged on as root and defined/added in the .kde/share/config/kdeglobals file the following:

[KDE Action Restrictions][$i]
shell_access=false

afterwards I logged out from the root account and in again, but I still could open with ALT-F2 a konsole window!

I have KDE 4.3.4 installed!

did you enforce a sycoca update?

I have KDE 4.3.4 installed!

Please don't expect too much support for that particular version

You mean to run kbuildsycoca4 (without parameters)?

The problem is, I am bound to KDE 4.3.4!

Here is the contents of my /root/.kde/share/config/kdeglobals file:

[$Version]
update_info=kded.upd:kde3.0,kwin.upd:kde3.2Xinerama,mouse_cursor_theme.upd:kde3.4.99,kaccel.upd:kde3.3/r1

[General]
XftHintStyle=hintmedium
desktopFont=Sans Serif,12,-1,5,50,0,0,0,0,0
fixed=Monospace,12,-1,5,50,0,0,0,0,0
font=Sans Serif,12,-1,5,50,0,0,0,0,0
menuFont=Sans Serif,12,-1,5,50,0,0,0,0,0
smallestReadableFont=Sans Serif,10,-1,5,50,0,0,0,0,0
taskbarFont=Sans Serif,12,-1,5,50,0,0,0,0,0
toolBarFont=Sans Serif,10,-1,5,50,0,0,0,0,0

[KDE]
ShowDeleteCommand=false
SingleClick=true

[KFileDialog Settings]
Automatically select filename extension=true
Breadcrumb Navigation=true
Decoration position=0
LocationCombo Completionmode=5
PathCombo Completionmode=5
Previews=false
Recent URLs[$e]=/usr/share/backgrounds/images,/media/CM-LME/bash-problems
Show Bookmarks=false
Show Full Path=false
Show Preview=false
Show Speedbar=true
Show hidden files=false
Sort by=Name
Sort reversed=false
Speedbar Width=104
View Style=Simple

[KDE Action Restrictions] [$i]
action/showmenu=false
shell_access=false
run_command=false
action/run_command=false

[KShortcutsDialog Settings]
Dialog Size=600,480

[PreviewSettings]
MaximumSize=5242880
UseFileThumbnails=true

[WM]
activeFont=Sans Serif,11,-1,5,75,0,0,0,0,0

The stuff I added KDE Action Restrictions] [$i] is in bold.

Here is the contents of my /root/.kde/share/config/kdeglobals file:

Nope, has to happen in system level dirs (unless you're trying for the root user, no good idea, for exploration only - and i've no idea whether that works) like /usr/share/config/kdeglobals - /root/.kde has no impact on eg. ~gromit (unless you added root to the KDEDIRS and made it world readable - what you should absolutely *not* do at all, by no means, for no reason, never!

Seen http://techbase.kde.org/KDE_System_Admi ... troduction ?

You mean to run kbuildsycoca4 (without parameters)?

also try "--noincremental" and (as root) "--noincremental --global" (just in case things don't work automatically)

Correct, I put kdeglobals into the directory /usr/share/config/ performed a kbuildsycoca4 --noincremental and the konsole window disappeared from the Start Menu.
The problem I have now is, how can I specify in the kdeglobals file that only certain users will have e.g. no Konsole menu entry/access?

Note: executing kbuildsycoca4 --noincremental --global gives me the error Error writing database "usr/share/config"! Disk full?.

I don't know whether such differentiation is supported by kiosk, but you can of course now make use of KDEDIRS to control which user sees what global config files (ie. you add /usr/restricted/share/config/kdeglobals with the required kiosk settings and in /usr/share/config/kdm/Xsession -i think- control the KDEDIRS var by the UID)

btw, you do not assume that this is a security feature, do you?

Note: executing kbuildsycoca4 --noincremental --global gives me the error Error writing database "usr/share/config"! Disk full

Either you operate on some ro mouted disk, the disk is indeed full (not good) or you didn't run with required permissions (root)