I've tried removing and re-adding. renaming and re-adding with the same result. I think you're right that it's not a kix issue as I get this in the winlogon.log:

----Configure Group Membership...
Configure Administrators.
Error 1789: The trust relationship between this workstation and the primary domain failed.
Error occurred during lookup of all accounts.
Group Membership configuration was completed with one or more errors.

Given that the Default Domain Controller Policy contains Authenticated Users and Everyone I can't understand what the problem is.