Do this as domain admin, evt. on your domain controller
Go in the folder
\\DomainController\sysvol\YourDomain.Extension\Policies\{That-Strange-Unique-Number}\User\Scripts\Logon\
You should find kix32.exe in that folder
Right click kix32.exe
go to properties
Go to General
I presume at the bottom you should see the "Advanced" button
Is there also an "Unblock" button?