Working on enabling gridpp, camont and totalep VOs I realised that the DPM disk servers had never been brought under cfengine control. This was a little trickier as it was the first set of SLC4 servers which were done, but in 30 minutes they were all ticking along happily, automatically updating authentication and other files.
There's still something rotten on disk035, which consistently refuses to yum update, complaining that the fetch-crl package is required and conflicts with glite-SE_dpm_disk - despite being installed! Perhaps its RPM database is corrupted? The workaround is to forcibly uninstall fetch-crl and then yum update.
However, at some point we should probably drain this machine and re-install it.