This is something I came across a while back. When using 802.1x authentication the XP winlogon service will not wait for group policy to process before proceeding. The result, in my experience, is a DHCPNACK event in the event log and complete failure of group policy application. There is a reghack that will adjust the group policy wait time.

After you apply Windows XP Service Pack 2, you must add the GpNetworkStartTimeoutPolicyValue registry entry. This entry defines the number of seconds to wait before trying to run the Group Policy startup script again. To find the value that will work for your configuration, define a decimal value of 60, and then increase the value until the problem is resolved. To add the registry entry and to define the value, follow these steps:

  1. Click Start, click Run, type regedit, and then click OK.
  2. Expand the following subkey: <div class="indent"> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon </div>

  3. Right-click Winlogon, point to New, and then click DWORD Value.
  4. To name the new entry, type GpNetworkStartTimeoutPolicyValue, and then press ENTER.
  5. Right-click GpNetworkStartTimeoutPolicyValue, and then click Modify.
  6. Under Base, click Decimal.
  7. In the Value data box, type 60, and then click OK.
  8. Exit Registry Editor, and then restart the computer.
  9. If the Group Policy startup script does not run, increase the value of the GpNetworkStartTimeoutPolicyValue registry entry.

Honestly 60 seconds is probably a bit overkill. 15 to 30 seconds would probably be fine.