In the user roles you can select windows session start scripts
However you'll find that it wants to use a temp directory for running the script so you'll get an error kix32.exe is not recognized. To get around this do not call the kix script from here, use it run a regular login batch file. In that batch file map a drive to the netlogon share on the domain controller and have it call another batch file where you will call the kix script.
so the first batch file that you put in the sa device will be something like this
net use z: \\%Ip_of_server%\netlogon
z:
vpnlogin.bat
Then the vpnlogin.bat can call the kixtart and would look like this
%0\..\KIX32.EXE %0\..\vpn.kix
You can then have your kix script run just as if you were local on the network.
