We were having issue where our kixtart powered login script would hang on 2003 domain controllers. Clients were fine 2008/2012 dcs were fine. I was on the phone with support and they couldn't even find a log of the block happening but if we uninstalled SEP the script worked fine. It also could not find an SEPM exception that worked.
Local exception did work for C:\windows\sysvol\sysvol\domain\scripts\kix32.exe which has been my fix. Applying this along with things like %logonserver%\netlogon\kix32.exe or \\localhost\netlogon\kix32.exe didn't seem to affect anything. We also couldn't get kix32.exe to be seen after 24hours of waiting and having it marked as an application to watch in SEPM.
Our solution has been local exceptions for all 2003 DCs which shouldn't be around much longer.