sleekmountaincat

hello, i have a 2008 terminal server which is a member of an AD domain. i am trying to setup access via smartcards. logon works great, however, i need the session to disconnect when a smartcard is removed. i have set the 'Interactive logon: Smart card removal behavior' policy locally using the local computer group policy mmc. there are no conflicting AD group policies. i get the expected behavior maybe 20% percent of the time, the rest of the time removing a smart card has no effect. i have tried multiple readers and cards. the client computers i have tested with are xp sp3, and a thin client running rdesktop on top of thinstation (open source thinclient linux os). both clients exhibit same behavior. i can not reproduce the unexpected behavior, it seems to just work occasionally, and fail most of the time. i can not find any events, errors or otherwise, relating to smartcard removal in event viewer. the 'Smart Card' and 'Smart Card Removal Policy' services are started and set to automatic. ANY help would be greatly appreciated. thanks for your time, chris