Environment variables are irrelevant to this. (And there's nothing aside from environment variables that is conventionally named environment settings, so that distinction is meaningless.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor (for everyone machine-wide) or the
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Command Processor (for just one user) key in the registry, add a value named
AutoRun. It must be a
REG_EXPAND_SZ value. Microsoft's command processor will read the string every time that it starts up, and run the commands in the string before doing anything else.
TCC doesn't have a local-machine-versus-per-user configuration mechanism, although it's fairly simple to achieve that with some creative use of the
%USERPROFILE% environment variable. There's just the one script.
These commands are executed by every instance of the command processor that you start, whether you run it from WinKey+r, or an desktop shortcut names the command processor as the program to run, or a program "shells out" by invoking the command processor to do stuff. The local machine value will be used by any service that uses the command processor. You can break things quite seriously, and introduce major security hazards, if you do anything non-trivial, such as commands that change directory, generate output, run external commands, or modify the filesystem, with these mechanisms.
For best results, don't do this. Pass whatever you want to do in this script to the command processor on its command line, directly from the WinKey+r edit field, instead.