The userinit.exe binary checks for an environment variable called UserInitMprLogonScript. This variable isn’t set by default, but if defined then userinit.exe will run any script it specifies.

Unfortunately, there’s no way to set this globally — you have to do it one user at a time in the HKCU\Environment Registry key. Just create a new Expandable String Value entry called UserInitMprLogonScript in this key that points to the location of your payload.