I'm not sure where you got the idea that any script had credentials in it..
An admin script runs from your workstation, either when you log in as an admin, or employ RunAs to elevate your rights before you run the script (which is what we generally do). Then, from your workstation, you can perform functions against one or many remote systems. You control what runs, when it runs, where it runs, and what account runs it, without ever leaving your chair. You'll have to find another way to exercise this way. 
Alternatively, creating scheduled tasks allows the task to run on the remote system, either under direct software control or as a scheduled event. You specify the credentials that the task runs under, but no credentials are ever visible.
As for the registry key issue, I've never had one of my tags removed by a reg cleaning utility (which seems to be the first thing that the help desk does.. well, maybe second, after runing a file cleaner 
). Almost every one of my Kix-based utilities employs registry settings to control certain parameters.
Glenn
PS - after teaching at and supporting the classroom environments at two colleges and our training center over the past 15 years, I'm aware of the challenges of maintaining a school environment. You've got my respect and sympathy!
_________________________
Actually I
am a Rocket Scientist!
