If it is a GPO script then I believe the script will have Permissions to HKLM... that would eliminate the need to write to HLCU.