I am trying to use NAL as the shell when a student logs on, but have it
switch back to explorer (normal) shell when staff logs on.

Is there a simple way to do this in user (or other) policy somehow? (If
not, there should be!)

I can get it to work by using/calling regedit from the system login
script, but, the user logging in has to belong to the admin group on the
workstation in order to be able to change the appropriate part of the
registry. I'd rather not have to make students belong to that group.

Is there some way to get part of the login script to run as a secure user?

Any ideas to switch shells with the user?