[ActiveDir] Extremely weird issue

[Alex Etin]

Title: Kerberos question

I have encountered a very weird issue at this client.       The situation is as follows (i will do my best to try not to confuse    anyone).       Client has an AD domain. AD domain is 2003 based. Forest level: 2003    native. Domain level - 2003 native.       There is a few policies that are being applied. Some of them are applied    at the domain level, and some are applied at an OU level.       Being tested are 2 workstations. One of them has a clean build of Windows    2000 Pro, service pack 4. The other one, is also W2K Pr0 SP4, but it is a    custom client image. This image does not have any special application, but    it does have a few registry patches/entries applied to it, although from    what i have seen, its not distructive.       Here is the problem:       When the both machines, in the same OU start up, the client image    machine "gets stuck" during applicaiton of one of the domain wide policies    (before logon screen even appears, so it is computer policy that is being    processed). It will sit on this "stuck" stage, while "Processing Policy A"    is displayed. After 1.5 - 2 minutes the logon screen appears and all is    well. The clean build machine starts up with no delay. Now here is the    interesting bit: IF i unlink domain policy A, then the machine simply gets    stuck on policy B. If i unlink B and A, it will stuck on policy C. If i    Unlink A,B and C, it will get stuck on policy D (which applies at OU    level). None of these policies are complex, in fact A B and C only have 2-    3 entires in them. Plus, the clean build machine has no delays. Another    note - while in "stuck" stage, the HDD of the machine goes like crazy!       I have turned on UserEnvLogging, and i have a Severity B ticket open with    Microsoft, in fact i am on the phone with them now (have been for about 4    hours).       I have USERENV.LOG dumps if anyone is interested, i even found something    of interest there and i have pointed it out to MS support guy as well. So    far, nothing. The client needs this resolved asap, we need to find what in    the build is causing this problem. Redesigning the image is not an option    as client spend years developing it.       If anyone has seen anything like this, i would greatly greatly appreciate    your help!