Yes, that's correct, they're fired by AD group policy.

So yes, I don't think the .cmds are called in the users' context. In fact, they would likely be running under a domain admin account... so privs shouldn't be an issue, right?

Going to work w/ my domain admin, I'll get back to you if still unresolved.