The SIDs for the global groups to which a user is a member are attached to the users security token when the user logs on and is authenticated.
Under some circumstances the user may not have had the global groups properly added to the security token. If this happened then the INGROUP function may not yield the expected result. You can test this possibly by running a test script in a CMD window using the ENNUMGROUP function. This also read the groups from the security token. If no global groups are enumerated then you may have some kind of authentication issue.
In a W2K AD domain this process is done by the GC. If you have not properly setup your GCs or not properly configured your SITEs then this may be a side affect.
