It seems the problem was not in registry placement. The problem is in macros. For Explorer shell context menu extensions in Initialize() function you should use CF_HDROP. But for ADUC context menu extensions you should use CFSTR_DSOBJECTNAMES and CFSTR_DS_DISPLAY_SPEC_OPTIONS.
So the right line should be:
fe.cfFormat = RegisterClipboardFormat(...
The computer seems to be infected with a virus.
UAC bypass through Trusted Folder abuse
is a method for tricking Windows into running programs with
Administrator permissions, by using a blank-terminated
Windows \System32 folder.
The program doing it is named credwiz.exe. The name is legit,
but the program may not be the one that is part of Windows.
I think you're confusing GPO security filtering and GPO hierarchical scope. The security filtering ACLs only deal with accounts and groups, never with containers. On the other hand, GPOs can be linked directly underneath any OU (though not underneath built-in containers) without the need for security filtering. Groups and containers are not the same thing.