I have a question relating to the OAC connection properties.
The current configuration is:
both options for after logon use credentials cached and obtained through the ctrl-alt-del screen. They are not old cached credentials
If you see OAC trying a GINA login on the first try and not the second that typically means that a third party GINA has reinstated itself. You can confirm this by going to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and verifing the value of GINADLL. If the non MSGINA.dll is the value you need to determine if you can live without the other GINA. If you can't you may want to open a support call and see if there is anything we can do to make the 2 GINAs play nice.