Radimus -
I have see this also. Depending on the device connecting through seems to define their "authenticating" server. For example, with Shiva (no VPN to test with) we have seen this for Win2K, but WinNT/9x do process the script. Win2K/XP seem to believe the Shiva is the authenticating server, which of course is correct in one sense, but not from domain perspective. Once authenticated, there appears no further attempt to connect to domain server (which is all our experiences). Running SET command on limited test systems appears to back this up.

Now, how to force authentication beyond first-level to the DC's - still searching for that solution.

Bill