weird, sounds like there is 2 policies forcing it to happen.
could you do a trace (audit maybe) into log to see what is starting the script?
_________________________
!

download KiXnet