The users are all Admins of the machines. UAC is off on all of them. I've added a 10 second delay, just for good measure... The hardest part is it seems to come and go, so finding a good example to test on has been impossible.

Also, my thought that it was working with the AD Logon Script field filled in isn't working either. I had it running a batch file off the DC (\\DC\netlogon\logon.bat). When I manually try to run this I get prompted "We can't verify who created this file. Are you sure you want to open this file?" And then I have to click Open to get it to run. I'm guessing this is stopping it from running during the logon process.

I'm going a little crazy...