How do I edit Managed Client preferences without them getting replaced?
Turns out that the master copy of com.apple.applicationaccess is kept in /private/var/db/dslocal/nodes/Default/[user].plist. Editing that solved the problem for me. Thanks to Lyken for helping me find this on this question.