This requires admin rights (local admin at least) for the user loggin in. This isn't true for approx. 2990 out of my approx. 3000 Users.
Since I do a lot of system management by a set of really bulky loginscripts (just as you suggested), I stumbled over this specific limitation way to often. I learned to ask "can this be done by ordinary users ?" before I do anything else ...
And switching user context to a admin user by means of runas is no real option. You run into several difficulties as how to hide the password, changed %TEMP% due to the different user profile, etc.. Quite insecure and unpleasant.