It's a single domain across all the sites. And there are 3 domain controllers, 2 of which are in one site. So in that particular site, a user's computer could connect to either DC for authentication. Ideally, all the Kix files could be stored inside the GPO so that they would be launched and run from whichever domain controller is handling the login.

The way it's setup now, all the Kix files are in the netlogon shares of each DC. Group policy for the domain is set to run a .BAT file that calls KIX32.exe. The trouble I ran into was that in that .BAT file I had to specify exactly where KIX32.exe exists, and so I had to specify it on *one* particular domain controller. How can you call a program in .BAT file using a wildcard that refers to the authenticating DC's netlogon share?