Thanks to everyone for your help. It looks like this version of the restart is working for me:

Run "RUNDLL32 SHELL32.DLL,SHExitWindowsEx 2"

I'm running it against a test group when they log in tomorrow morning, so we'll see how it goes.