after registry permissions reset:
check group policy membership; it's probably wrong and may cause problems
under group membership

symptoms of a registry permissions problem:
- works on first login, but not after reboot / second login
(group policy objects in win7 apparently cached / not updated until after boot)
to identify keys that are still locked with wrong permissions:
try to apply some permission to all subkeys of the user key; stumbling blocks should cause "access denied" errors that identify the key.
note that exporting the entire user registry as a text file does not work; locked keys are either ignored or exported anyway, silently.