Open Directory account unexplained behavior

I have an extremely frustrating problem with my Open Directory, I run a 10.4.11 Xserve G5 OD master with a mix of 10.4.11 and 10.5.4 clients, it is by no means a complex or large implementation and has (touch wood) been stable and reliable for the last three years.

I now have an extremely frustrating problem whereby new users that I create cannot log in to new 10.5.4 clients bound to the OD.

Users already in the OD can log in to the 10.5.4 and 10.4.11 clients with no issue.

The newly created users can log into the 10.4.11 clients with no issue.

I cannot for the life of me see the difference between an “old” and “new” account even when inspecting them using WGMs inspector tab to view the users settings. I have tried creating new clients using the 10.4.11 servers local 10.4.x WGM and using a client machines 10.5.x WGM. Sadly for me this still results in the same behavior.

I don’t have any kind of access restriction for who can and cant log in applied via MCX and I cant see anything in the Server Managers OD log views.

Interestingly on one of the 10.5.4 clients if I log into the local administrators account and fire up the Kerberos application I can get myself a TGT from the OD domain using any account I like including one of the newly created ones that wont let me log in!

Anyone got any bright ideas about whats going on, or where I should be looking to get some idea of whats happening when I’m trying to in?

TIA
Stephen
(edit – spelling)