Instead of putting this in a login script, wouldn't it make more sense to make two GPOs? One, a system startup script simply checks if the audit software is installed on the system. If not, it installs it. A second GPO would tell each system to run the audit at some certain time during the day.