I've been down this road. One solution that we arrived at was to modify the acl of the key we were interested in such that the average user had the correct access. In our case it involved the winexit screen saver, which seems to require admin access to install. In general it seems that most things in HKCU are accessible through the users login script. We wrote a script to remotely modify the required registry properties (in HKLM). In a login script you cannot do this because the user does not have access.