commenting on option 4 you can use a free version of PolicyMaker (supported/recommended by MS and given away with their GPO Management books) which uses a free to distribute agent Client Side Extension to allow you to not just manage access but also create,modify or delete keys and values. In this case you would create a policy maker policy (or add to your current baseline or the most appropriate of your incremental policies) which would then come into affect when the user logs on. This would then also cover the users that have already been created as well
