thanks for the replies thus far.
Site 1 = (local) domain with 2003 server.
Site 2 = stand-alone machines, ethernet etc but no domain.
I 'disuade' users from loggin in locally on their machines on SITE1 so they use the network. SITE2 are even more prone to need help. Ideally clients on SITE2 boot local OS then looks for the DC (via the internet remote on SITE1), gets authentification etc and then loads like it was on SITE1. Is there a way, I guess it might involve a way calling for authentication through the gateway shortly after POST / BOOT or similar. Or should I try and make SITE2 clinets as thin as possible, locally lock down their accounts and stick a run TS after general logon ...