Mike,
Sync operation is recommended to insure all resources/procedures are performed before allowing the user access. I generally avoid policy based logon scripts because of the context they run in. I use login scripts to establish the user environment.
In recent tests at a fairly large site, the profile based login script processing the same group-based authoriztion logic ran in 4.45 seconds compared to the policy taking nearly 17 seconds to complete.
Also - policy changes won't take effect on logoff/logon unless you run a GPUPDATE /FORCE before logging off. Policies run at boot and roughly every 90 minutes thereafter unless manually applied.
Glenn
_________________________
Actually I
am a Rocket Scientist!
