Regardless of where you place the script, the determining factor is where the script will run. If it is in the logon script, even though it is in the NetLogon share of the DC, it still runs on the local client so ADSI would have to be installed.

My sample script $usr = GetObject("WinNT://"+@LDOMAIN+"/"+@UserID+",user") is intended to run on the client and requires ADSI. An admin script would be separate from the logon script and scheduled to run periodically on one machine with ADSI installed. You could use Task Scheduler for that.

The following sample will create an entry in and INI file only for those users that have an expiration set.
code:
 break on
$WorkDir ="C:\KiX4.02"
$domain = GetObject("WinNT://"+@domain)
$domain.filter = "user",""
for each $user in $domain
  $AccountExpirationDate = $user.AccountExpirationDate
  $UserName = $user.name
  $RC = WriteProfileString($WorkDir + "\Users.ini","$UserName","AccountExpirationDate",$AccountExpirationDate)
next
get $_
After that all that is needed is to ReadProfileString() from the logon script and you're good to go.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.