Forgotten Password Challenge-Response Problem

On two of my three workstation types, I cannot get Challenge-Response to work from the "Forgotten Password" link. On the other type of machine (and on some laptops) it works perfectly. So I believe the error is client-related rather than server-related.

After clicking the link and saying I want to authenticate via C-R I get the following message:

Internal error 0xFFFFF96A occurred.

If I log on to the machine I can reset challenge-responses via User Admin / Challenge-Response admin from the Netware client "N" in the system tray, so some bits of C-R are working.

All the machines have the same setup
WinXP SP2 with all recent patches
Netware Client 4.91 SP4 (build 4.91..4.20070720)
NMAS Client: 3.4.0.47
CRLCM.DLL 2.7.5.0 (22/06/2007)

Servers are NW 6.5 SP7

I've tried un-installing and re-installing the client, and re-installing it over the top - no luck.
I've done an NMAS log and the reelvent bit seems to be:

Line#: Time: ThreadID:
======== ========= ==========
00000001 [14:31:44 0x000002EC] [winlogon.exe]**>NMAS_ClientLoginEx
00000002 [14:31:44 0x000002EC] [winlogon.exe]MAF Context Handle:
00000003 [14:31:44 0x000002EC] [winlogon.exe] transportFunc: 0x52E72D20
00000004 [14:31:44 0x000002EC] [winlogon.exe] transportArg: 0x0006AFB0
00000005 [14:31:44 0x000002EC] [winlogon.exe] atEndFunc: 0x52E72D60
00000006 [14:31:44 0x000002EC] [winlogon.exe] atEndArg: 0x0006AFB0
00000007 [14:31:44 0x000002EC] [winlogon.exe] nmasID: -1
00000008 [14:31:44 0x000002EC] [winlogon.exe] featureFlags: 0x00000000
00000009 [14:31:44 0x000002EC] [winlogon.exe] options: 0x000000D0
00000010 [14:31:44 0x000002EC] [winlogon.exe] uiHandle: 0x000300B6
00000011 [14:31:44 0x000002EC] [winlogon.exe] uiTimeout: 0x00000096
00000012 [14:31:44 0x000002EC] [winlogon.exe] TreeName: STCC-TREE
00000013 [14:31:44 0x000002EC] [winlogon.exe] Name: CN=<user>.OU=<ouname>.OU=<ouname.O=<tree>
00000014 [14:31:44 0x000002EC] [winlogon.exe] Password: (NULL)
00000015 [14:31:44 0x000002EC] [winlogon.exe] Sequence: Challenge Response
00000016 [14:31:44 0x000002EC] [winlogon.exe] Clearance: (NULL)
00000017 [14:31:44 0x000002EC] [winlogon.exe]Running Method: 31, crlcm.dll
00000018 [14:31:44 0x000002EC] [winlogon.exe] [Method] [CR] MSG: LSM Protocol Version: 0x00000100
00000019 [14:31:44 0x000002EC] [winlogon.exe] [Method] [CR] MSG: LSM HMAC Algs: 0x00000100
00000020 [14:31:44 0x000002EC] [winlogon.exe] [Method] [CR] MSG: LSM Challenges: 2
00000021 [14:31:44 0x000002EC] [winlogon.exe] [Method] [CR] Sending error to LSM: -1686
00000022 [14:31:44 0x000002EC] [winlogon.exe]Method: 31, returned: 0
00000023 [14:31:47 0x000002EC] [winlogon.exe]mh->atEndFunc rc: 0
00000024 [14:31:47 0x000002EC] [winlogon.exe]<**NMAS_ClientLoginEx returning: -1686
00000025 [14:32:05 0x000002EC] [winlogon.exe]**>NMAS_ClientLoginEx

Any advice would be appreciated.

Rob