SD - thanks for quick reply! Zone Alarm (on the Host) is 'allowing' the IP of the client for the original network, and I am not sure what difference there is with a second 'user'? ZA settings on the client are 'all users' and allow the network.
I should add that the host can access shared files on the second user but the second user does not have the 'permission' to go the other way.
The router is MAC and IP filtered but I do not see that these are changing with user.