Thanks - I've worked it out now - you have to copy KIX32 into the logon script directory on the authenticating server (this doesn't appear in anybody's manual!)