I found a good article on this... and it appears that %logonmode% worked at one time, but broke at some point. There doesn't seem to be a real good answer for this.

http://us.generation-nt.com/answer/detecting-cached-credentials-nt-2k-xp-03-help-27431502.html