The issue I've encountered is when users have changed the local admin password. That blocks remote options like WMI, scripts, etc. The best solution is to have the computer invoke a startup script to run in the local system context and reset itself. That works great, but the concern is locking down the script from all sides of hacking. Not always 100% obviously. That leaves GPO and MSI pushing, but that's typically a one-time thing (software install), not a recurring event (every reboot). There are retail products to handle this, but the appeal of Kix is that it's (a) free (b) powerful and flexible and (c) free.