After much digging, adaware installing etc I found out a few things
- I could bring up task manager and end the explorer.exe process and relaunch it and get in
- I could usually unplug the network cables first and then get in (logging in from the cached account)
- if I renamed the file wualcts.exe, the system would complain, but then would work fine the next restart (apart from the wualcts.exe not found message) - this process is not found in a google search

So as a workaround i've renamed the file on affected machines, I assume wualcts.exe has something to do with Windows Update, and one of them is currently downloading SP4 and every other update to see if that will correct the problem.
Our NC consultant doesn't even know what could be causing this!