OK guys, thanks to everyone who looked at this, but as you can see, I didn't get any sort of repsonse.
The wiki stuff suggests that Authentication is only required/desirable if you are exposing your server to the internet. In practise, it seems to be required if you are going to re-sync from anywhere, including your own network.
My requirement is still only to get changes from the server out to clients and not vice versa. So to get round this, I changed my external program command on the clients. from /MCC 20032, which attempts to re-sync, to /Library [library name], which just reloads the existing library.
This works a treat. The only thing I'd like, if it were possible, would be a confirmation message. The libary sync command comes back to theatre view with a nice confirmation message, but the library load does not. Any ideas?