DLU / Roaming Profile on Windows XP machines

Hello,

Newbie on ZCM, always worked with Zfd.

Setup :
ZCM 11 SP2
user profiles on a NSS share.
Not in home directories ( is this neccesary ? )

Logon with user name gives :
Policy does not allow interactive logon

When I use the workstation logon after that, the only allowed profile is Administrator.
More : the Administrator profile gets loaded onto the WS.
When I then check the ZCM agent, it reports it's logged on as the user ...

Any ideas ?

Stephan