First I added a user to an existing group. Using EnumGroup() I learned that the script did not know about the group membership. Relog did not help. So it seems best to flush the cache every logon. (My clients don't have patience for a scheduled flush.)

We used KiXtart 4.2 for two years without problems. That's why I suspected version 4.5.