samba - Sep 2004 - Samba PDC:Win XP client:profile problem:must be local admin

I've got a problem with roaming profiles.  I've googled, trolled the
mailing lists, and read the documentation.

Problem details
I'm running samba 3.0.7 as PDC with WinXP clients.  When I log onto
WinXP as a domain user the profile is downloaded (you can tell because
it takes a while and hub is lit up) but the profile won't load
properly.  Specifically I notice that the desktop is blank, there is
no XP theme/style, and the start menu is empty.  If i've previously
added that user to the local admin group on the WinXP box, then
everything is fine.  If I subsequently remove the user from the local
admin group (put user in Power Users or Users) the problem returns. 
There is no error message and a cached or default profile doesn't
load.  The same problem happens for multiple users.  Profiles for
local (non-domain) users load fine with any group membership.

What I've tried:
Upgrade Samba from 2.2.x to 3.0.7 (from rpm on samba.org)
Identify if problem is related to one or both XP boxes--both.
Fresh install of XP.
Set "Check ownership of profile" option in local policy (gpedit.msc)
to "disabled."
Look in system logs for related error messages.

Configuration:
Server/PDC:
RH9 w/Samba 3.0.7 (problem occured with 2.2.x as well)
see smb.conf at the end

Clients:
Windows XP SP2 (problem occured with pre-SP1 & SP1a also)

I can't tell if it's a WinXP problem or a samba/linux problem. 
Perhaps there's something I should check with regard to ownership &
permissions on the files & directories in the profiles?  It almost
seems as if there's some conflict (permissions/ownership/attributes?)
that being local Administrator allows you to override.

Thanks in advance for the help

ps If there are any unrelated problems in my smb.conf please let me know.

Here's the smb.conf--it's basically the same as it was in 2.2.x:

[global]
netbios name = BABYLON
workgroup = CIVILIZATION
browseable = no
server string = Samba Server
log file = /var/log/samba/smbd.log
max log size = 50
security = user
smb passwd file = /etc/samba/smbpasswd
unix password sync = Yes
passwd program = /usr/bin/passwd %u
passwd chat = \
		*password* %n\n \
		*password* %n\n \
		*successfully*
username map = /etc/samba/smbusers
# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
local master = yes
os level = 64
domain master = yes 
preferred master = yes
domain logons = yes
logon path = \\%L\Profiles\%U
logon drive = M:
logon home = \\%L\%U
logon script = logon.cmd
wins support = yes
dns proxy = no 

[homes]
	comment = Home Directories
	path = /home/samba/share/%U
	writeable = yes
	create mode = 0600
	directory mode = 0740
	browseable = No

[netlogon]
	comment = Network Logon Service
	path = /home/samba/netlogon
	browseable = no


[Profiles]
	path = /home/samba/profiles
	browseable = No
	writeable = yes


[share]
	path = /home/samba/share
	writeable = yes
	guest ok = no
	create mode = 0660
	directory mode = 0770
	browseable = yes