I can't reduce the script to this one site because other sites are already using it. Any change to that script is a production change
Ok, but you can run the script stand-alone on a PC at the site once it the user has logged in, can't you? In which case you could run a cut down version for debugging or testing. The same error should occur at both login and once the login has completed.
Any way I can do a flush without actually running the script? I'd like to see if I can correct the issue without forcing a production change
Sure - the cache is just a registry key. Delete it from the profile of the user that is having the problem, and KiXtart will recreate it.
The key is: HKEY_CURRENT_USER\Software\KiXtart\TokenCache
Also, is there any damage to forcing Kix to refresh cache every time it loads?
Yes - you can either use the "-f" flag without a date, or you can delete the registry key when your script starts.
The overhead with deleting the cache is that KiXtart has to enumerate the group structure each time, which may impact logon times depending on the complexity of your structure, and the speed of the connection between the client and the authenticating server.
