samba - Oct 1998 - intermittent login failures (Win95/Samba 1.9.18p10)

We are using Windows 95 OSR 2 clients here in our lab in 
conjunction with Samba 1.9.18p10 on Linux kernel 2.0.35.

We are getting intermittent login failures that I can't
figure out. The user will type their username and password
in, hit OK, and the system will respond, "The domain
password you supplied is not correct, or access to your
logon server has been denied." If the user simply
hits OK again (without changing entries), within 2 or 3
tries, they will be authenticated successfully. I don't know
what to look for here. Can anyone help?

here's a dump of my smb.conf (from testparm):
# Global parameters
        debuglevel = 2
        syslog = 1
        syslog only = No
        protocol = NT1
        security = USER
        max disk size = 0
        lpq cache time = 10
        announce as = NT
        encrypt passwords = No
        update encrypted = No
        getwd cache = Yes
        read prediction = No
        read bmpx = Yes
        read raw = Yes
        write raw = Yes
        use rhosts = No
        load printers = Yes
        null passwords = No
        strip dot = No
        bind interfaces only = No
        networkstation user login = No
        password server         socket options = TCP_NODELAY
        netbios name         netbios aliases = athens
        smbrun = /usr/bin/smbrun
        log file = /var/log/samba/log.smb
        config file = /etc/smb.conf.%U
        smb passwd file = /etc/smbpasswd
        hosts equiv         preload         server string = File Server
(Students; Lilly Lab)
        printcap name = /etc/printcap
        lock dir = /var/lock/samba
        root directory = /
        default service         message command = /bin/mail -s 'Message from
%f on %m' root < %s
; rm %s
        dfree command         passwd program = /usr/bin/smbpasswd
        passwd chat = *old*password* %o\n *new*password* %n\n
*new*password* %n\n *changed*
        passwd chat debug = No
        valid chars         workgroup = CTSLILLY
        username map         character set         logon script = %m.bat
        logon path = \\%L\profiles
        logon drive         logon home = \\%L\profiles
        remote announce         remote browse sync         homedir map        
announce version = 4.2
        max log size = 50
        mangled stack = 50
        max mux = 50
        max xmit = 65535
        max packet = 65535
        name resolve order = wins bcast host
        packet size = 65535
        password level = 0
        username level = 0
        keepalive = 0
        deadtime = 5
        time offset = 0
        read size = 16384
        shared mem size = 102400
        coding system         client code page = 850
        os level = 35
        max ttl = 14400
        max wins ttl = 259200
        min wins ttl = 21600
        lm announce = Auto
        lm interval = 60
        dns proxy = Yes
        wins support = No
        wins proxy = No
        wins server = <another box>
        preferred master = Yes
        local master = Yes
        domain master = Yes
        domain logons = Yes
        browse list = Yes
        unix realname = Yes
        NIS homedir = No
        unix password sync = No
        time server = No
        ole locking compatibility = Yes
        printer driver file = /home/samba/printers/printers.def
# Default service parameters
        comment         copy         include         exec         postexec      
root preexec         root postexec         alternate permissions = No
        revalidate = No
        default case = lower
        case sensitive = No
        preserve case = Yes
        short preserve case = Yes
        mangle case = No
        mangling char = ~
        browseable = Yes
available = Yes
        path         username         guest account = guest
        invalid users         valid users         admin users         read list 
write list         volume         force user         force group         read
only = Yes
        max connections = 0
        min print space = 0
        create mask = 0744
        force create mode = 00
        directory mask = 0755
        force directory mode = 00
        set directory = No
        status = Yes
hide dot files = Yes
        delete veto files = No
        veto files         hide files         veto oplock files         guest
only = No
        guest ok = No
        print ok = No
        postscript = No
        map system = No
        map hidden = No
        map archive = Yes
        locking = Yes
        strict locking = No
        share modes = Yes
        oplocks = Yes
        only user = No
        wide links = Yes
        follow symlinks = Yes
        sync always = No
        strict sync = No
mangled names = Yes
        fake oplocks = No
        printing = bsd
        print command = lpr -r -P%p %s
        lpq command = lpq -P%p
        lprm command = lprm -P%p %j
        lppause command         lpresume command         queuepause command     
queueresume command         printer         printer driver = NULL
        printer driver location         dont descend         magic script       
magic output         mangled map         delete readonly = No
        dos filetimes = Yes
dos filetimes = Yes
        dos filetime resolution = No
        fake directory create times = No

[homes]
        comment = Home Directory
        exec = /usr/bin/quota -u %u | /usr/bin/gawk '/hda/ {print "You
are curre
ntly using", $2, "Kilobytes of disk space."; print "Your
total storage
allotment
 is", $4, "Kilobytes."}' | /usr/bin/smbclient -M %m -I %I -U
root&
        browseable = No
        path = /home/%u/winhome
        read only = No
        create mask = 0700
        directory mask = 0700

[netlogon]
        comment = Initialization scripts
        root preexec = echo set USER=%u > /netlogon/%m.bat ; cat
/netlogon/start
up.bat >> /netlogon/%m.bat
        browseable = No
        path = /netlogon
        locking = No

[profiles]
        path = /home/%U/settings
        read only = No
        create mask = 0700
        directory mask = 0700
        guest ok = Yes