The group cache is stored in the registry key HKEY_CURRENT_USER\Software\KiXtart\TokenCache and can be flushed by either deleting the key or launching KiX32.EXE /F.

For non-wintendos, I believe the authenticating DC (assuming it is also a GC) is where KiX will query for the group.

I warned you about using special characters like hyphens in the group name. If using hyphens, make sure you wrap quotes around the name or KiX tries math on it.

To get this straight, the user is in a different domain from the one the group is in?

As for optimized network, I am not talking about LAN and WAN speeds. It is more a function of providers and protocols. For example, if you have IPX and NetWare or/and IBM CAE, they will hijaak the provider order which affects InGroup().
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.