I think I've just nailed it. It's because as domain user you don't have permissions to write to the HKLM.
You're nearly correct. Each key in the registry has a permission. This is very like the permissions on folders in the file systems, and you can view them using regedit.
This means that you *can* write to HKLM, as long as you are granted permission to.
The key that you were trying to write to is part of the policy feature of Windows, which is used by administrators to enforce configuration. Of course you don't want your users to be able to write to this area, otherwise they could undo any restriction in place.
It is for this reason you cannot write to "\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Updates" - it doesn't matter if you prefix it with HKCU or HKEY_CURRENT_USER, both will fail.
I recommend that you create your own key e.g. "HKCU\software\Xempa" and write your value there.
