This one's a doozy. I've got a test policy to run an agent for our Cymphonix web filter box (the agent logs the user into the box to track usage, etc.). I have it setup to run as a logon script for the user, simply calling the .exe.

-Note: The current problem with it is that Windows hangs upon login because it's waiting for the agent to terminate, which it doesn't because it's called from a command prompt and is an active program, so I have to either turn off the PC or wait the 10-minute timeout period. (Bonus: Win7 does not have this issue it seems, only XP. All of our users are on XP.)

Now, I have this GP assigned only to our IT OU to test it, which it successfully (sort of) works when I login, hanging for the 10-minute timeout. All of a sudden, I start getting users around campus complaining about their "computer hanging after logging in for 10-15 minutes". I pull GPResults on the user on their computer and cannot find any trace of my test GP running at all. However, I remove the test GP totally and - tada! - users no longer hang on login!

How can a policy attach itself to users without actually attaching itself to users? None of these users are in my test OU and it doesn't show in GPResults or GPModeling, so what's going on?

Oh, environment: DCs are 2008 Server, clients are XP.