Am I misunderstanding you, Richard?

Is this much different than having a service that simply gives different credentials to a program or command being run in KiXtart? Kind of like a "hidden" SU?

$Object.Execute("kixtart command line","domain\administrator")

Basically specifying the permissions you want to use to execute a KiXtart command. (How to implement something like this sounds tricky, though.)

Brian