I see what you're saying. It's possible that this user isn't getting the GPO- i could test this by waiting until the next time the logon script doesn't run, then see if "log out" is on the start menu since the GPO adds that. (also if the preference is there to enable the log off button on the start menu i know the GPO didn't run because the GPO would have taken that off.)..

So if all of this is true then I wonder how I could solve this problem of GPO's not always running. This GPO is never really edited. I just set it up when we created the 2000 domain.