Access to Chrome via the System Tray should go through the User Manager.

chrome/browser/background/background_mode_manager.cc

Index: chrome/browser/background/background_mode_manager.cc
diff --git a/chrome/browser/background/background_mode_manager.cc b/chrome/browser/background/background_mode_manager.cc
index 8260dac752b764e908d35d74fff8cd0beb2ec80f..6a931a12a40fe0fe4f13ce7abd12c6e7c7b65188 100644
--- a/chrome/browser/background/background_mode_manager.cc
+++ b/chrome/browser/background/background_mode_manager.cc
@@ -28,6 +28,7 @@
 #include "chrome/browser/status_icons/status_tray.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
+#include "chrome/browser/ui/browser_dialogs.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/chrome_pages.h"
@@ -483,19 +484,42 @@ void BackgroundModeManager::OnProfileNameChanged(
   }
 }
 
+BackgroundModeManager::BackgroundModeData*
+BackgroundModeManager::GetBackgroundModeDataForLastProfile() const {
+  Profile* most_recent_profile = g_browser_process->profile_manager()->
+      GetLastUsedProfileAllowedByPolicy();
+  BackgroundModeInfoMap::const_iterator profile_background_data =
+      background_mode_data_.find(most_recent_profile);
+
+  if (profile_background_data == background_mode_data_.end())
+    return NULL;
+
+  // Do not permit a locked profile to be used to open a browser.
+  ProfileInfoCache& cache =
+      g_browser_process->profile_manager()->GetProfileInfoCache();
+  if (cache.ProfileIsSigninRequiredAtIndex(cache.GetIndexOfProfileWithPath(
+      profile_background_data->first->GetPath())))
+    return NULL;
+
+  return profile_background_data->second.get();
+}
+
 ///////////////////////////////////////////////////////////////////////////////
 //  BackgroundModeManager::BackgroundModeData, StatusIconMenuModel overrides
 void BackgroundModeManager::ExecuteCommand(int command_id, int event_flags) {
-  // When a browser window is necessary, we use the first profile. The windows
-  // opened for these commands are not profile-specific, so any profile would
-  // work and the first is convenient.
-  BackgroundModeData* bmd = background_mode_data_.begin()->second.get();
+  BackgroundModeData* bmd = GetBackgroundModeDataForLastProfile();
   switch (command_id) {
     case IDC_ABOUT:
-      chrome::ShowAboutChrome(bmd->GetBrowserWindow());
+      if (bmd)
+        chrome::ShowAboutChrome(bmd->GetBrowserWindow());
+      else
+        chrome::ShowUserManagerThenAboutChrome();
       break;
     case IDC_TASK_MANAGER:
-      chrome::OpenTaskManager(bmd->GetBrowserWindow());
+      if (bmd)
+        chrome::OpenTaskManager(bmd->GetBrowserWindow());
+      else
+        chrome::ShowUserManagerThenTaskManager();
       break;
     case IDC_EXIT:
       content::RecordAction(UserMetricsAction("Exit"));