default session variables and domain splitting

Peter's answer is right on the money from what I've seen for the three variables in the split, although sometimes you will get a logonname of domainname\uid - its really just whats typed in the box.

The branch rule expression I use to determine forests is like the below (for one example branch) - where the split option is on in the logon box. The last one searches for the forest DNS suffix and the || give you or options

expr {
    [string tolower [mcget {session.last.logon.domain}]] == "netbios1"
    ||
    [string tolower [mcget {session.last.logon.domain}]] == "netbios2"
    ||
    [string first -nocase ".forestdns.com" [mcget {session.last.logon.domain}]] >= 0
}