Yup. That approach would be pretty easy to spoof:
No idea, i'm assuming this kind of login is "just" for logging/tracking purposes and not to deterimine user rights. As ignition would not know who has admin roles in windows.
So it wouldn't be the worst if it was wrong
Make sure the batfile cant be changed without admin rights:)
But yes, this is not safe, could be enough for logging though