There are some installs that are not immediately critical, but seem to fail due to some service still running or some other conflict with another windows process. I have seen one particular install issue that is critical (antiVirus) where the SEP update installs then uninstalls immediately after installing, causing the pc to be left with no antivirus. THis has happened on 30 or so pc's in my environment.
Rather than prompting the user for the updates & relying on them to "defer until next login", I'd rather have it done silently (or with a status bar in some cases) before windows starts, but prior to all other windows files being loaded.
In non-critical cases, I don't want to necessarily force a restart, but give users a wide range of time for that particular restart & install option, separate from my agent setting which is at a 7 hour limit. In critical cases like AV, I'd like to shorten this to a couple of hours max, with a prompt or window to show that it is installing. In particular the AV set as a runonce takes a long time to process & just shows a blank desktop, so to the end user, the pc is seemingly frozen. They will often hard-power down the laptop thinking there is an issue & the AV does not get installed.
It should be fine at login, as long as it runs like the RunOnce key prior to the other services that are starting. I'd prefer some to run similar to the way Windows Updates pops up with that "Configuring Windows" text just prior to the login window showing up. Still, the key remains that it needs to be run as System or a local pc admin account & not as the user logging in.