What client OS?
My guess is that after connecting to the network via VPN, the computer, if NT/W2K/XP, has not yet established its secure channel with a DC of the domain to which it is a member. Without the secure channel the client can not contact the DC.
You may be able to check this out by re-running the logon script again after a period of time (60-120 seconds) if it fails. If it operates currently this time, then possibly the client has setup the required communication channel to support the gathering of macro data from the authentication domain.
