After further analysis this behavior is caused by Kaspersky Endpoint Security 10 anti-virus running in the background. It seems that this A/V software rescans applets both inside and outside a windows virtual machine. Once this was disabled Kaspersky A/V the Web Client response time returned to normal.
Therefore it is no longer written to c:\winnt\java\lib ( or some equivalent dir in 98 / XP) where admin rights are required, but instead in user's temp location where users have full rights. If customer is having problems with the applet, most likely it's not file perms but IE perms. Also note that if you previously chose to "always trust Serena" you will no longer get the trust prompt, and the applet will be delivered silently.
