Does anyone know a simple method to determine whether a local or roaming profile is in use, and at which stage it can be determined?

The problem is that occasionally (far too often) the anti-virus software on our file server goes mental and consumes all CPU.

During busy logon periods this can degrade the response times for profiles such that the login process will decide that the profile is not available and generate a local profile. This is a major problem as these logins happen on a Citrix farm.

I thought that I'd disabled local profiles, but I guess that in extreme situations they are still created.