I'm going to say what others have said, but a little differently, as I've done this very thing with a couple of god-awful programs (both of which are polling programs for time clocks-- what is it with programs that poll time clocks being sucky crap?):
Logon to the server computer as the user who will run the application. Set the user's screensaver to be secure (i.e. require a password). You should probably use "blank screen" to save CPU.
Place shortcuts to your script to start the application and test for its "aliveness" into the "All Users" "Startup" group. (Be sure that your script gives the application ample time to actually start before checking whether it's "dead".)
Grab a copy of "nircmd" from http://www.nirsoft.net/utils/nircmd2.html and throw it into the %SystemRoot%\System32 directory (or anywhere, really). Add a shortcut to the "All Users" "Startup" group to call:
Add the following registry values, substituting in the appropriate username and password.
AutoAdminLogon - REG_SZ - 1
DefaultUsername - REG_SZ - Set to user name to logon with
DefaultPassword - REG_SZ - Set to password to logon with
DefaultDomain - REG_SZ - Set to either local machine's name if a local account is used to logon, or domain's name if a domain account is used to logon.
ForceAutoLogon - REG_SZ - 1
- Modify the permission on the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key (using REGEDT32) to remove the "Power Users" and "Users" groups from the ACL on that key. (I just tested this on a W2K machine, and it does not disrupt the autologon). This will prevent the plaintext password from being read by a limited-access user on the box.
At this point, the computer will boot and automatically logon as the user you've specified, start the application and your "deadness" script, and immediately go into a locked screensaver. The key being held during boot won't stop the auto-logon (but, since this is off-site, hopefully they keyboard / mouse are secured anyway).
If you can run it on W2K3, you can use the "/admin" or "/console" argument on the Remote Desktop client (depending on which version you have-- do a "/?" to see) to connect to the console session. You will need to logon with the same username and password used by the autologon account, and anybody w/o that username and password won't be able to connect to the console session.
If you have to stick to running it on W2K, install something like VNC so that you can take remote control of the console session. If you do use VNC, be sure to modify the permission on the registry key where the machine VNC configuration is stored (HKEY_LOCAL_MACHINE\Software\ORL\Winvnc for older versions, other places for newer versions) to remove "Users" and "Power Users" from the key's ACL. This will prevent limted-access users from reading the VNC password hash, which can easily be reversed back into the VNC password.
That's how I'd do it.