To my experience, the best way to do this would indeed be through a script at login or logoff. Don’t know if you could push this as a policy.
There is a program called AdminP which might be able to do just this (among other things…). Not being a Notes administrator, I simply know of its’ existance. Can anyone else shed some light on whether this might be an appropriate tool?
Also, there is another Tech Target site called SearchDomino.com: have you posted there?