What isn't working is getting SQLCMD to run in the context of the user that's login in/out.

I had assumed that the policy would execute under a system/admin account.

But you're right, I'll seek help in more appropriate fora.

Thanks John.