I'm building a login script for our company. Some of the things it will do include installing printers, mapping drives, setting wallpapers, etc. Many of these things will require elevated permissions. Many of these things will also require the username (IE cannot be run as system, must have user context to check groups, etc).
I first looked at Intune/MEM (we are 100% M365/Azure, no on-prem servers). You can go to AzureAD > Devices > Scripts and apply a script, but my understanding is that this only runs once and then again if it is changed, not at every login as desired.
Second I tried shell:common startup. I quickly realized this would result in a UAC prompt at every login (making registry changes, etc). No go.
Then I tried a scheduled task. This works well as you can run it as the user with "highest privileges" toggle. The problem I ran into here is that you have to create the task under each user. I really need this to apply to all users as well as future users. IE, if a new user logs into a conference room PC I need it to run the script immediately.
So, that's where I stand. What are my options? Is there a way to create a system wide scheduled task that runs at login of every user under the user context? Am I missing something with Microsoft Endpoint Management that constitutes a proper login script? Group Policy? I think the startup folder is completely out, but open to options here too (do not want to disable UAC though).