Delayed logons are often a dns issue in that the computer is having a
problem finding a domain controller and may be ultimately logging on with
cached credentials. I would verify that your dns is configured correctly in
that W2K/XP Pro domain computers point ONLY to domain controllers running
dns and having the AD domain zone as their preferred dns servers. ISP dns
servers in the list can often be the cause of delayed logons as the computer
tries to locate the domain _srv records on it. The link below explaines
proper dns configuration in an Active Directory domain.

http://support.microsoft.com/default.as ... s%3B291382

Another possibility is there is a problem with domain controller or
controllers in their dns configuration and/or replication. The support tools
netdiag and dcdiag should be helpful to you. I would run first netdiag and
then dcdiag on your domain controllers looking for any failed
tests/errors/warnings that may help pinpoint the problem. Netdiag can also
be used on domain member computers. In particular look for failed
tests/warnings/errors for dns, dclist, kerberos, and trust/secure channel.
Also check the Event Viewer of domain controllers and domain computer for
any pertinent errors and try to ping the domain controller, preferred dns
servers from the domain client by IP address and fully qualified domain name
to establish basic connectivity. If you have enabled an require or request
ipsec policy in your domain without exempting domain controllers from the
policy that can cause very long logon times and/or logon failures. The
netdiag test will show if an ipsec policy has been assigned. The /v switch
will show much more detailed info for netdaig and dcdiag if problems are
found.