Thanks for all the usefull responses guys.The purpose of the original q. was to allow me to provide our non-technical admin staff with a method of creating individual user profiles whilst keeping them well away from NT policy admin. The users access their desktop on a Terminal Server + Metaframe server farm.
I've done this by defining a group for each resource ("MS Office", "Email", "Oracle" for example). At login the script scrubs any entries already in the users %userprofile%\desktop, then enumerates all the groups that the user is a member of. If there is a directory in the configuration share with the same name as the group then:
1. Any .lnk files are copied to the users desktop.
2. If a "logon.kix" is present it is run.
The logon.kix is a per-resource script used to set/create sane values for registry entries, and create directories necessary for the resource.
Drive mappings (group "Map C to client") and international settings (group "Locale UK") are also handled by group membership.
I know I've been a little verbose, but maybe the info will help someone else, or more likely expose a fundamental flaw in the design 