It has to be something with authentication. I think our AT&T router for VPN and our 3com switch for RAS clients both authenticate the user. When it finally, actually, gets to the domain, it's already processed and the script doesn't get called.

Is there a way to pass the authentication token through to the domain controller?

Bob