I may have to take a look at your script myself Glenn as some basic testing I performed a while back would not modify restricted HKCU keys of a limited user.

Though I'm not a big fan of GPO control freak admins myself, but for the advanced admin there is just about nothing a GPO can't be made to do and should be able to be used on other Domains as well. One of the International Domains from my old company ran a ton of customized GPO stuff that was not built-in and it works well but I hate the long logon process when you would log onto their Domain - for me it was overkill.

I'll try to stop by your site next week if it's available to the public. Don't see you on IM anymore these days. Hope all is going well for you.