Why don't you just add the process to the startup script?
Are your users set up as local admins on their boxes?
You're asking about how to do something rather dangerous. How will you check if the box is on? You will have "fun" processing the CTRL+ALT+DEL that is setup as a blocker from malicious scripting, and at the point of the CAD I dont think anything else is running. Once you get past the CAD, you will have to wait an undertermined amount of time to ensure the system has fully started up and all your network drives are connected, so you can reference whatever your after. Once you have that verified you have to run your lil' updater. Part of the updaters process may include restarting, which will really fung your process. How will you know your not supposed to start over again? Once your updater has finished you need to log off, and how do you verified you actually logged off? You may wind up leaving someone logged in with Admin rights.
FYI, what if the user has spyware on their box, and you log in as ADMIN and give the spyware full permissions. BAm your network just got holed.
Oh, and by the way, I was trying to be optimistic.
Lodlaiden.
-The answer to your problem may not be the answer to your question.