Probably some sort of config file or program somewhere.
If that doesn't work, I recommend group and permission juggling:
chmod 750 <kcontrol>
chown root <kcontrol>
chgrp tobesetup <kcontrol>
Replace <kcontrol> with whereever the kcontrol executable is. And the group doesn't have to be called "tobesetup".
Anyway, when setting up a new account, temporarily make that account part of the tobesetup group. Run kcontrol as that account and set up the generics. Remove the account from the tobesetup group and you're set!