I have used DCGPOfix many times in my field consulting. As long as you back up your existing GPOs before you run it you can always get back to where you were. It can be a valueable tool to getting back to a starting point if a previous admin made a mistake in GPO assignments.
The reason I am thinking GPOs is that GPOs could modify the Local Policies -- User Rights assignments. Normally the default policy would have this as Not Defined. Try running from your GPMC a RSOP against one of the machines having the issue and choose to have it return the results to you for the user that would normally log into that box. Check the user Rights assignment to see if it is being modified.
