One other thing you might want to check with the group is the "Pre-2000" Group Name in Active Directory.. Or, look at ENUMGROUP from KiX or even IFMEMBER /v /l from the RESOURCE Kit to list out the groups that are in question for this/these user(s).
Kent
