This message was deleted.

From GPO prospective that‘s the right tactical way. But there will be still some traps. When the system or application for example takes precedence over the HKLM key maybe you won‘t be able for activating it for your single user with the exception HKCU Key.

I have the answer, you can't have the same parameter in hkcu and hklm