As documented in the links I have previously supplied, KiXtart 4.x checks the groups that are attached to the user's security token that is generated during the logon process.
You have not yet painted a complete infrastructure picture.
I now know that you have an old NT4 domain with some computers. And you have a new W2K domain with new computer as members.
You have not described how the user account are managed, migrated, or where they exist. Do the user's of the new computers in the new domain logon using accounts in the OLD NT4 domain or in the W2K domain?
From where does your logon execute for the computer in the new domain?
