I have adapted the SIMSPERM batch file so that it can be applied as a Startup Script via Group Policy.

@echo off

if not exist "%ProgramFiles%\SIMS" goto end

if exist "%ProgramFiles%\SIMS\doneperm.txt" goto end

path \\[color="red"]server[/color]\netlogon

SubInAcl /FILE %WINDIR%\SIMS.INI /GRANT=[color="red"]domain\group[/color]=F
SubInAcl /SUBDIRECTORIES "%ProgramFiles%\SIMS\*.*" /GRANT=[color="red"]domain\group[/color]=F
SubInAcl /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes /GRANT=[color="red"]domain\group[/color]
SubInAcl /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID /GRANT=[color="red"]domain\group[/color]
SubInAcl /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface /GRANT=[color="red"]domain\group[/color]
SubInAcl /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib /GRANT=[color="red"]domain\group[/color]

echo y >"%ProgramFiles%\SIMS\doneperm.txt"

:end

Notes: SubInAcl.exe must be copied to the netlogon folder.

This has been tested with Windows XP only. Not sure if it will work on Vista/7.