This is particularly directed at the IE7 and i would assume 8 upgrades. I have a fix for the RunOnce reg entry but to deploy this on a wide scale has been, let's say, challenging. I'm sure I'm probably missing something. My latest atempt involves three things
1.) An update to the client to accept policies
2.) Run the IE7 upgrade
3.) Run the RunOnce registry update to prevent the go.microsoft.com first run page
I have tried chaining #3 to an install at next logon DM but this works sporadically at best
I could do a custom definition but i am in the same boat as well.