You need to flush the group token cache on *ALL* clients, either by using the "/f" switch, or by deleting the registry entry.