You might consider a little-documented method called ActiveSetup. You can define a script that runs once, and only once, for each user at their next login. This is used by things like Internet Explorer or Windows Shell updates, where on next login a little window appears that says “Configuring settings for Internet Explorer” (or Media Player or etc…)
I have an example at https://bigfix.me/fixlet/details/3914