My thought on how to prevent spoofing of the domain SID (and your other information), would be to have a server-side service running that would be able to send a unique code to the .dll assuming that .dll was called from the logon script. It could be seeded by a number chosen randomly when installed, or by one chosen by the person installing the service.

Brian