you guys, he has a HARDWARE vpn tunnel, there is no issue with the tunnel being up before the user tries to login, also, in a domain controller environment the user wont be able to log on to the domain if the client computer is unable to contact the domain controller. so basically if these guys are able to log on, then they should be recieving the script. check thier active directory settings.