I would leave the domain in the InGroup() as DOC suggests.

Both NOT and KeyExist() are version dependent. What is @KiX?

I find "%logonserver%" to be unreliable and sinfully slow on XP in an AD 2000 environment. I would go with:
Shell '\\domain.tld\netlogon\site\app.exe'
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.