Well, our Change Advisory Board has approved our rollout and deployment has begun. Here's what we ended up with:

Our installer adds the following registry keys to redirect "My Documents" to the H:
 Code:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal"="H:\\"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Personal"=hex(2):48,00,3a,00,5c,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetCache]
"Enabled"=dword:00000000


Here's the install batch file:
 Code:
@ECHO OFF
CLS
ECHO.
ECHO.
ECHO You MUST be logged in as the user WITH Admin Rights
ECHO to successfully complete this installation.
ECHO If you are NOT, abort this script now.
ECHO.
ECHO.
PAUSE
ECHO.
ECHO.
ECHO Setting up the registry for "My Documents" redirection
ECHO Setting up the registry to turn OFF "File Synchronization"
regedit /s PersonalRedirect.reg
ECHO.
ECHO.
ECHO Copying necessary files...
COPY MapDrives.bat "C:\Program Files\Sentillion\Vergence Authenticator" /y
rem COPY Authenticator.ini "C:\Program Files\Sentillion\Vergence Authenticator" /y
MD "C:\Program Files\Sentillion\Vergence Authenticator\Kix"
COPY .\Kix\*.exe "C:\Program Files\Sentillion\Vergence Authenticator\Kix" /y
COPY .\Kix\*.chm "C:\Program Files\Sentillion\Vergence Authenticator\Kix" /y
COPY .\Kix\*.dll "C:\Program Files\Sentillion\Vergence Authenticator\Kix" /y
COPY .\Kix\*.kix "C:\Program Files\Sentillion\Vergence Authenticator\Kix" /y
COPY .\Kix\*.lnk "C:\Documents and Settings\All Users\Desktop" /y
ECHO.
ECHO.
ECHO Now the hard part.  You need to make 2 changes to Authenticator.ini.
ECHO I will open it for you in a moment.
ECHO Find the line "Path=" ABOUT 20 to 25 lines down.  Change it to:
ECHO.
ECHO Path="C:\Program Files\Sentillion\Vergence Authenticator\MapDrives.bat"
ECHO.
ECHO Next you need to find the line "Valsa=CredAgent.exe" (A few lines further down)
ECHO All you need to do is put a semi-colon (;) in front of it.
ECHO.
ECHO I will open Authenticator.ini after this pause.
ECHO.
PAUSE
NOTEPAD "C:\Program Files\Sentillion\Vergence Authenticator\Authenticator.ini"
ECHO.
ECHO.
ECHO When you are finished with the file please remove the user's Admin rights.
ECHO Do that now please.
ECHO.
ECHO.
ECHO Installation is complete.
ECHO Please restart the PC.
ECHO.
PAUSE

Once the install is completed and the file MapDrives.bat is placed, when a user logs in the DESKTOP it is executed. The IF statement needs to be there because (according to vendor) this file will run at both logon and logoff (I don't know why, but they say it does. Seems poorly planned to me).
 Code:
@echo off
IF %3 == "" GOTO END
cd "C:\Program Files\Sentillion\Vergence Authenticator\Kix"
kix32.exe MCGroups.kix /f %3 %1 %2 /i
EXIT
:END

Obviously, all that does is run the KiXtart script, which is here:
 Code:
;Program:    MCGroups.KIX
;Author:     John K. Fischer with tremendous help from
;            Allen Powell of www.KiXtart.org
;Version:    1.0.0  May 27, 2010
;Action:     
;Dependencies:   Kix32.exe 4.61
; 

use G: /DELETE
use H: /DELETE
use I: /DELETE
use J: /DELETE
use K: /DELETE
use L: /DELETE
use N: /DELETE
use O: /DELETE
use P: /DELETE
use Q: /DELETE
use R: /DELETE
use V: /DELETE
use W: /DELETE
use X: /DELETE
use Y: /DELETE
use Z: /DELETE

; Have to delete these so they can be mapped for the DT user.
; Can only have one logged in user per server connection and
; the Generic ID already connected.  S: and T: can be left
; alone since we are not attempting a second connection to
; that particular server
use M: /DELETE
use U: /DELETE

GLOBAL $CL, $Credentials, $Dm, $UN, $PW, $Folder

; Lets parse the CommandLine and make it more friendly
for each $Arg in GetCommandLine(1)
	$Ct = $Ct + 1
 	if $Ct = 4 $Dm = $Arg endif
	if $Ct = 5 $UN = $Arg endif
	if $Ct = 6 $PW = $Arg endif
next
$Credentials = $DM + "\" + $UN

; ALL users in the E.D. should have this drive
$Folder = "\\hospfilesrv\" + $UN + "$$"
use H: $Folder /user:$Credentials /password:$PW

; Check and make sure user has a home folder and give the
; instructions if they do not.
IF NOT EXIST ("H:\")
   $Text = "Home Folder does not exist." + @CRLF
   $Text = $Text + "Please call 323-8586 and request access for the following folder: " + @CRLF
   $Text = $Text + "\\hospfilesrv\$UN$$"
   MESSAGEBOX ($Text, "Home Folder Missing", 4160, 20)
ENDIF


;Author:     Allen Powell
; He combined a couple of things into a more elegant piece of code.
; This is where all of the drive mappings should be located and they
; are all based upon a users group membership in Active Directory.
for each $groupname in GetADUserGroups($Credentials)
    if instr($groupname,"ERcommon")
        use I: "\\hospfilesrv\ss2\ed\ercommon" /user:$Credentials /password:$PW
    endif
    if $groupname="neotransport"
        use J: "\\hospfilesrv\neotransport$" /user:$Credentials /password:$PW
    endif
    if $groupname="edmgt"
        use K: "\\hospfilesrv\edmgt" /user:$Credentials /password:$PW
    endif
    if $groupname="EDTRANSPORT on HOSPFILESRV READ WRITE"
        use L: "\\hospfilesrv\edtransport" /user:$Credentials /password:$PW
    endif
    if $groupname="Softmed"
        use M: "\\hospfilesrv\him\employee\updates\vpn\unsignedorders" /user:$Credentials /password:$PW
        use U: "\\hospfilesrv\him" /user:$Credentials /password:$PW
    endif
    if $groupname="Local Machine Admin"
        use Y: "\\mctech02repo\backup"  /user:$Credentials /password:$PW
        use Z: "\\mctech\software"  /user:$Credentials /password:$PW
    endif
next

;Function:   GetADUserGroups() - Get User Properties / Attributes from Active Directory  
;Author:     Allen Powell  
;Version:    1.0.0  2010/05/13 
;Action:     Get a Users Groups from Active Directory  
;Syntax:     GetADUserGroups(optional $user, optional $mode)  
;Parameters: 
;   $user(optional)   Supply the user name in the form of USERNAME or DOMAIN\USERNAME.
;                     If ommitted, will default to the current user. 
;   $mode(optional)   0 = GroupNames, 1 = Group OU Names.  Defaults to GroupNames   
;Returns:    An array of groupnames, or nothing  
;Dependencies:   None  
;Example: 
;  for each $group in GetADUsergroups("username") 
;    ? $group 
;  next 
; 
function getADUserGroups(optional $username, optional $mode)
  Dim $objTrans, $objUser, $group, $array[0], $i
  if $username=""
    $username=@ldomain + "\"+ @userid
  endif
  if not instr($username,"\")
    $username=@ldomain + "\" + $username
  endif
  $objTrans = CreateObject("NameTranslate")
  if @error
    exit @error
  else
    $objTrans.Init(3, "")
    $objTrans.Set(3,$username)
    $username = $objTrans.Get(1)
    if @error
      exit @error
    else
      for each $group in getobject("LDAP://" + $username).GetEx("memberof")
        redim preserve $array[$i]
        if $mode=0
          $array[$i]=GetObject("LDAP://" + $Group).cn
        else
          $array[$i]=$group          
        endif
        $i=$i+1
      next
      $getADUserGroups=$array  
    endif
  endif
endfunction


Our end users are loving this. They are finally getting a private folder that will be available no matter where they are, they still have a shared documents folder on the local PC, and they are getting the proper mappings for $hares they need to access.

Here is part of what I had to submit to the CAB for them to look over, along with a demo and a beta group of 5 machines.

 Code:
Pre-requisites:

System:
1. Must have “File Synchronization” turned off in registry
 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetCache]
 "Enabled"=dword:00000000
2.Generic ID MUST have “My Documents” redirected to H:\
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal"="H:\\"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Personal"=hex(2):48,00,3a,00,5c,00,00,00

Vergence:
1. "C:\Program Files\Sentillion\Vergence Authenticator" must contain:
   a. "MapDrives.bat"
   b. Authenticator.ini with the following line changes:
      Path="C:\Program Files\Sentillion\Vergence Authenticator\MapDrives.bat"
      ;Valsa=CredAgent.exe
2. KiXtart:
   a. "C:\Program Files\Sentillion\Vergence Authenticator\Kix" must contain:
      Document Archives.lnk
      KiX32.exe
      KiXtart.dll
      MCGroups.KIX
      Kixhelp453.chm
3. Generic ID:
   a.Must be a member of the "Softmed" group (for S: and T:)

4. Desktop user ID:
   a. Must have a home folder \\hospfilesrv\home\%Username%$ (for H:)
      i. Must be accessible as \\hospfilesrv\%Username%$
   b. Must be a member of one of the following groups (for I:)
      i. "ercommon"
      ii. "ERcommon on HOSPFILESERVER READ WRITE"
      iii. "ERcommon on HOSPFILESERVER READ ONLY"
   c. E.D. Transporters: "EDTRANSPORT on HOSPFILESRV READ WRITE" (for J:)
   d. E.D. Managers: "edmgt" (for K:)
   e. "Softmed" (for M: and U:)
 
 
Workflow:
1. Generic ID logs into the OS and Vergence presents a login screen for the Desktop user
   a.Drives S: and T: are mapped for Softmed under these credentials
2. Desktop user logs in via “Tap & Go” or the keyboard
3. Vergence launches “MapDrives.bat” via Authenticator.ini passing:
   a. Desktop Username as %1
   b. Desktop Password as %2
   c. Desktop Domain as %3
4. “Mapdrives.bat” then
   a. Checks to see if this is a logon or logoff
      i. If Logoff:
         1. exit the batch file
         2. end all scripting
         3. present the Vergence login screen for next user
      ii. If Logon: launch “MCGroup.KIX”, passing same credentials as above
5. “MCGroup.KIX” then:
   a. Clears all drives that may be left from previous user
   b. Attempts to create users Home folder (H:)
      i. Success = Yes
         1. Continue Script
      ii. Success = No
         1. Notify user to call help-desk and have a home folder created
         2. Continue Script
   c. Query LDAP and create an array of all groups the Desktop user is a member of
   d. Map appropriate drives based upon group membership
      i. “Ercommon*”, I:
         1. \\hospfilesrv\ss2\ed\ercommon
      ii. “Softmed”, M: and U:
         1. \\hospfilesrv\him\employee\updates\vpn\unsignedorders
         2. \\hospfilesrv\him
      iii. “neotransport”, J:
         1. \\hospfilesrv\neotransport$
      iv. “edmgt”, K:
         1. \\hospfilesrv\edmgt
      v. "EDTRANSPORT on HOSPFILESRV READ WRITE", L:
         1. \\hospfilesrv\edtransport
      vi. “Local machine Admin”, Y: and Z:
         1. \\mctech02repo\backup
         2. \\mctech\software
6. Desktop user is presented with the desktop and PC is ready for use


Again, my thanks to Allen Powell. Without his assistance this might never have come to fruition so quickly.

And now, I wish all of you a great weekend and wonderful next week. I'll be on vacation in the mountains!
_________________________
John K. Fischer
University of Kentucky
HealthCare - ITS