I have tried several variations.

The script does return the correct path to runnas.exe on netlogon, and to client.bat whether client.bat is on the netlogon root, netlogon\sms or a mapped drive.

Here is the error I get using code below.

Map Error was execute: 1 - Incorrect function.
\\ADS02\netlogon\sms\client.bat \\ADS02\netlogon\runnas.exe

 Code:
nul = SetOption("NoVarsInStrings", "On")
$nul = SetOption("NoMacrosInStrings", "On")

$network=@lserver+"\netlogon\sms\client.bat"

if @error<>0 'Map Error was server: ' + $network + ' ' + @ERROR + ' - ' + @SERROR ? endif

$runaspath = @lserver + "\netlogon\runnas.exe"

if @error<>0 'Map Error was runaspath: ' + $runaspath + ' ' + @ERROR + ' - ' + @SERROR ? endif

$cmd = '"' + $runaspath + '" user:domain\helpdesk "' + $network + '" /pass:password'
Shell $cmd

if @error<>0 'Map Error was execute: ' + @ERROR + ' - ' + @SERROR ? endif
$network + '  ' + $runaspath