Run with user privileges but write to restricted folder

Question

In Windows Server 2008 R2 (and in an Active Directory domain), the login and logoff scripts are run with user privileges.
Suppose that I run script1.ps1, when user1 logs in; I need that script1.ps1 is associated to user1, because it will write some informations about that user: it modifies a log file in a folder. Anyway, script1.ps1 will be run with user1 privileges.
I obviously made that file and that folder accessible (readable/writable) to user1: but I actually don't want the user to modify that log file. I would like that
only the script could do it.
Is there a way to work around this problem? Maybe should I run script1.ps1 in a different way?

Answer 1

Henry.  You can add a subscription to a server that subscribes t event log entries on user computers.  Subscribe to the logon/logoff events. Now you have a central repository of logon and  logoff events.
There is no way to accomplish what you are asking to do.  Any file that can be written to in logon script or during a user session can be changed by the user.
Bil is suggesting a "startup" script that runs when the user logs on and not when the computer starts.  A user startup script runs as the user and not system.
Another method is to schedule a script that run at logon.  This can run as system and write to a file that the user cannot change.
¯\_(ツ)_/¯