We specially use a RUN '%comspec% /c kix32 user_script.kix'
to prevent users to influence the main script, but to prevent also
you - as network administrator - influence their script.
some possible problems:
- multiple usage of variable names
- open files
- script of user abort kix32.exe by his script
- unexpected changes take place by the client

Questions:

• what kind of things are your users doing with kixtart?
  - modifying registry keys?
  - removing policies?
  - changing printers?
  - changing desktop + startmenu settings?
  - .....
  
• how does you check users aren't use illegal activities with kixtart?
  
• what was the reason for this policy within your organisation? so we mention earlier: it is
  the first time users may and can do this kind of things.
  something what we can accept is that an user enter some information and an additional
  program will create automatically a piece of kixtart code which will run by your
  main script.
  
• what kind of problems you discover by users scripts?
  

Greetings.

btw: Shawn good points.