You deploy a custom image by using Sysprep.exe and an Unattend.xml answer file that contains the SkipMachineOobe or SkipUserOobe tag.
When users log on, they see the following message, and then they are logged off:
Now we can go look for any updates.
If users then try to log on again, they can complete the first-time logon process, and they don't see the problem recur.