If you want to have a script run when a user logs in and/or logs out then you’ll likely want to look into using login and logout hooks. A hook is a script that runs as root (although you can execute as the user with su). Hooks are enabled in the /var/root/Library/Preferences/com.apple.loginwindow. You can do so using defaults, writing the path to the script into LoginHook as a string as follows:
defaults write com.apple.loginwindow LoginHook /scripts/script.sh
If you only want to run the script once (ie – at first login) then you can end the script with a defaults command that will then reset the field.
defaults write com.apple.loginwindow LogoutHook /scripts/scripts.sh
