I'm just wondering if anyone has put together a method of forcing users to enrol. Probably at least half the people in the company haven't enrolled (either because they are new and dont know about it, they ignored the communications, or are just lazy). Then when they go to use it..... computer says no.

Right now i'm thinking an SQL query to find who is already enrolled, then match that against an AD extract to get the exceptions. Put them in a group or something, and perhaps use a script or policy to fire up a browser with the enrolment at login (with all the usual communications before hand so they know what's happening). 

or actually, might be better to add all the people that are already enrolled into a group and use the group as an exception list. Then i can run the query every night and keep it updated as people enrol - so they dont get it every login.

Has anyone done anything like this?