I am trying to provide a one time message at the logon screen. I have automated a software install process, which is triggered remotely (by Powershell Remote Job) only when no user is logged in to the machine. After the install completes the machine is restarted. But I need to provide some clue to the user that the machine is now ready, as I don't want them logging in before the install completes and the restart is triggered. I found this reference to adding a message via LocalPolicies, but it is really more suited to a persistent message. I want a user logon script to be able to reset the message so it can be a one time thing. But of course Local Policy is not normally editable to a non Local Admin user. My first thought is to have my Install script, which is running as Local Admin, change the permissions on the two Message properties to allow Authenticated Users to edit these two properties. This seems slightly iffy. Alternatively I could perhaps use saved credentials of the Local Admin account, but that seems even more iffy. The solution needs to work in Win7, Win8 and all builds of Win10.
Is there a better option than these two, or is one of these two considered acceptable security policy? Or is this just something that can't be done in Windows without violating best practices?