Clients are a mix of 2k/xp.

Delaying execution of the logon script does not ssem to make a difference.

But executing "nltest /sc_reset:domainname" before executing the script seems to kick things back into shape.

Thanks for all your help Howard - I think I can code around this problem by resetting the secure channel if required...

Barry.