I think he stated that he replaced kix32.exe on his netlogons and even ran it locally but should verify this ... he must replace all copies of kix32.exe on both (all) his DC's ... he also states that he calls kix32.exe right out of user manager so no batch file involved - although I like the idea of maybe temp. replacing this statement with a call to a dummy bat file that has a PAUSE in it ...

Think we need to know whether kix32 gets started or not, only way is to put a tracer in or check-out task manager or something.

By the way, wonder if he's running synchronous or asynchronous scripts ... sounds like he's running asynch so maybe he could flip that to see if any diff.