I don't see any problems with your script. However, I do things slightly differently when using SU. Instead of setting a SU_PASSWORD Environment variable, I just pipe the password directly to SU. I also omit the <domain> at the end of the SU command line options.

I don't see any reason that these would be causing a problem, but those differ from the way I've used SU successfully several times.

I'm not sure what BAT2EXEC your using, but I use BAT2EXEC 1.5 from Ziff Communications Co. To encrypt my ".com" file, I use Secure v2.1b.