your problem most likely lies in the fact theat Safeboot replaces the boot gina. usually this will be msgina, but in your case it may be the cisco Gina? If not it may been causing the problem with passing signle sign on
I'm now 100% convinced that it's the O2Micro smartcard reader drivers that are the problem. I've even let windows update install some Microsoft generic drivers, but they upset the VPN software as well.
I don't manage the server end, just the laptop/desktop builds, currently about 150 out there and growing slowly.
Thanks for the post by the way, saved me a few grey hairs and a lot of time.
Now I only need a foolproof method of deploying it in a Ghost image.
The Cisco VPN client must be configured to start prior to login. Then you can run this reg script to fix the ordering problem. This can also cause winlogon crashes or SAS errors when booting up, if it is not loaded right.
Basically, you tell Windows to load SBGINA.DLL as first logon component. SBGINA then passes this control to CSGina.dll, which should then pass it to MSGina.dll. If you do not have any third party GINA components, set SB-OrigGinaDLL to blank.
If the machine will not boot in normal mode, perform the registry changes in Safe Mode.