I found a bunch of posts and articles that seem to point to an answer, but
not "how" to solve the problem.

We have ZCm 10.0.2 running on a OES 2 server. Many of our client
workstations are having this or similar problems authenticating to our
management zone. Workstations that have a clean installation of the OS
(typically Win XP sp2) are not having the problem. However any workstation
that has been in service for awhile and has the ZENworks client added will
most likely have a login problem. I'm obviously missing something. . .

Login fails but the ZENworks properties show the server, the workstation
policies and everything but the user related information.

One set of solutions point to DNS. All the workstations both old and new
resolve the name and IP address of the ZEN works server correctly.

Another solution pointed to not being able to resolve the name of the server
in the certificate. As far as I can tell the name of the server in the
certificate is correct.

The log files from other TID's related to login issues got me the log files,
but no solutions. Example log entries are as follows:

ZENLGN.LOG:

ZENLGN [1A0-1A4] [16:01:15] ZenLgnLoginUI entered
ZENLGN [1A0-1A4] [16:01:15] It would appear that we have been called from
the Winlogon process (NWGina.dll)
ZENLGN [1A0-1A4] [16:01:15] AUTHTOKENLoadDLL called!
ZENLGN [1A0-1A4] [16:01:15] MICASALoadDLL called!
ZENLGN [1A0-1A4] [16:01:15] WTSLoadDLL called!
ZENLGN [1A0-1A4] [16:01:15] WTSLoadDLL returning
ZENLGN [1A0-1A4] [16:01:15] RegQueryValueEx on value DisablePassiveModeLogin
Failed: 2
ZENLGN [1A0-1A4] [16:01:15] CheckIfLoginAllowed Entered
ZENLGN [1A0-1A4] [16:01:15] Checking if this machine is an NT Server.
ZENLGN [1A0-1A4] [16:01:15] Microsoft Windows XP ZENLGN [1A0-1A4] [16:01:15]
Professional
ZENLGN [1A0-1A4] [16:01:15] CheckIfLoginAllowed returning TRUE
ZENLGN [1A0-1A4] [16:01:15] IsWorkstationConnected entered
ZENLGN [1A0-1A4] [16:01:15] IsWorkstationConnected returning 0
ZENLGN [1A0-1A4] [16:01:15] Calling ZENGetAssociatedRealmNames
ZENLGN [1A0-1A4] [16:01:16] ZENGetAssociatedRealmNames returned
ZENLGN [1A0-1A4] [16:01:16] Found Realm : MHTN_TREE
ZENLGN [1A0-1A4] [16:01:16] We found 1 realm(s).
ZENLGN [1A0-1A4] [16:01:16] bTryLoginWithoutPrompt is TRUE
ZENLGN [1A0-1A4] [16:01:16] LgnGetPassiveLoginRetryParameters entered
ZENLGN [1A0-1A4] [16:01:16] *pdwRetryCount = 0
ZENLGN [1A0-1A4] [16:01:16] *pdwRetryInterval = 15000
ZENLGN [1A0-1A4] [16:01:16] ZenLgnLogin entered
ZENLGN [1A0-1A4] [16:01:16] Calling ZenLgnSetCasaCredentials
ZENLGN [1A0-1A4] [16:01:16] ZenLgnSetCasaCredential entered
ZENLGN [1A0-1A4] [16:01:16] Username is: Test
ZENLGN [1A0-1A4] [16:01:16] RealmName is: MHTN_TREE
ZENLGN [1A0-1A4] [16:01:16] About to call miCasaSetCredential
ZENLGN [1A0-1A4] [16:01:17] Returned from calling miCasaSetCredential
ZENLGN [1A0-1A4] [16:01:17] miCASASetCredential successful for MHTN_TREE!.
ZENLGN [1A0-1A4] [16:01:17] ZenLgnSetCasaCredential returning 0
ZENLGN [1A0-1A4] [16:01:17] ZenLgnSetCasaCredentials returned
ZENLGN [1A0-1A4] [16:01:17] Calling ZENGetHostNames
ZENLGN [1A0-1A4] [16:01:17] ZENGetHostNames returned
ZENLGN [1A0-1A4] [16:01:17] Retrieved host names are:
ZENLGN [1A0-1A4] [16:01:17] isis.mhtn.com
ZENLGN [1A0-1A4] [16:01:17] 192.168.1.3
ZENLGN [1A0-1A4] [16:01:17] About to call ObtainAuthToken with the following
parameters
ZENLGN [1A0-1A4] [16:01:17] szServiceNameA is:
com.novell.zenworks.MHTN_TREE
ZENLGN [1A0-1A4] [16:01:17] szHostNameA is: isis.mhtn.com
ZENLGN [1A0-1A4] [16:01:17] dwAuthTokenSize is: 0
ZENLGN [1A0-1A4] [16:01:19] ObtainAuthToken Failed: 0xC7FF0001
ZENLGN [1A0-1A4] [16:01:19] About to call ObtainAuthToken with the following
parameters
ZENLGN [1A0-1A4] [16:01:19] szServiceNameA is:
com.novell.zenworks.MHTN_TREE
ZENLGN [1A0-1A4] [16:01:19] szHostNameA is: 192.168.1.3
ZENLGN [1A0-1A4] [16:01:19] dwAuthTokenSize is: 0
ZENLGN [1A0-1A4] [16:01:20] ObtainAuthToken Failed: 0xC7FF0001

NWGINA.LOG:

[15:51:12] [NWGINA-1A0-1A4] Calling NWLoginUI
[16:01:15] [NWGINA-1A0-1A4] LoginLocalForGUILogin Entered
[16:01:15] [NWGINA-1A0-1A4] STOG: Tree = MHTN_TREE
[16:01:15] [NWGINA-1A0-1A4] STOG: Server = HERA
[16:01:15] [NWGINA-1A0-1A4] CheckIfDLUAccountNameShouldUseNDSAliasName
entered.
[16:01:15] [NWGINA-1A0-1A4] RegOpenKeyEx Failed: 2
[16:01:15] [NWGINA-1A0-1A4] CheckIfDLUAccountNameShouldUseNDSAliasName
FALSE
[16:01:15] [NWGINA-1A0-1A4] Skipping ImpersonateLoggedOnUser because
hUserToken is NULL.
[16:01:15] [NWGINA-1A0-1A4] STOG: Login Script =
[16:01:15] [NWGINA-1A0-1A4] STOG: Profile Script =
[16:01:15] [NWGINA-1A0-1A4] argPtr = pNwContext->startInfo->cmdLine =
0x328f3b0
[16:01:15] [NWGINA-1A0-1A4] STOG: Username = Test
[16:01:15] [NWGINA-1A0-1A4] STOG: Context = SLC.MHTN
[16:01:15] [NWGINA-1A0-1A4] STOG: Tree = MHTN_TREE
[16:01:15] [NWGINA-1A0-1A4] GinaGetTypedUserDN entered
[16:01:15] [NWGINA-1A0-1A4] Reading object info for : Test.SLC.MHTN
[16:01:15] [NWGINA-1A0-1A4] User's typed DN : CN=Test.OU=SLC.O=MHTN
[16:01:15] [NWGINA-1A0-1A4] GinaRemoveBackslashesFromStrings entered
[16:01:15] [NWGINA-1A0-1A4] GinaGetTypedUserDN returning 0
[16:01:15] [NWGINA-1A0-1A4] GinaZenLogin entered
[16:01:15] [NWGINA-1A0-1A4] GinaSetWinlogonTimeoutValue entered
[16:01:15] [NWGINA-1A0-1A4] Screen saver timeout is 605

The ATS.LOG does not seem to have any error messages at corresponding
times.

Does anyone have a clue as to what is going on and how to fix it. I've been
beating my head against this wall for three weeks now and can't seem to get
a break.