Thanks for all your help thus far, much appreciatted!
This weekend I've reconfigured the WINS to have the fsmo primary push/pull to all other 4 WINS servers and each of those to only push/pull with the fsmo primary, the 'hub'. In addition I've removed all other IPs from the TCPIP settings on each WINS server.
I've setup scavenging on the entire DNS domain of No-refresh 5 + refresh 7 (12 days cycle) but the primary server is NOT enabled to scavenge. I've removed all other servers with the dnscmd to stop servers scavenging.
So in effect I should be doing the process of aging entries to then 'sanity check' the extract after 12 days looking for tombstoned entires etc as per the earlier article posted - I believe this is correct?
Now I have a problem, we have a reverse lookup zone for our remote users who dial-in via secure ID on our 'AppGate' appliance. The scavenge period was actually enabled and set to 1+1 days (not sure who did this) and the TTL is 45 minutes.
Yet last night I logged on remotely, obtained an IP in this range and the DNS entry never updated, it still listed 'my' IP under another machines name...
This is the problem I'm actually trying to fix and avoid, is my understanding of DNS wrong here because I expected DNS to update with my laptops information?