I just deleted the whole key, which recreated when rerunning kix. Interesting find though, in the cache, if there's identical groups in the domain that the workstation belongs versus the userid of the domain the user is logging into, kix registers the workstations domain for those groups first.

For example:
Domain "A" is a W2000 Active Directory domain. Workstation "123" is a member of "A"
Groups "Apples" "Oranges" and "Bananas" are in "A"

Domain "B" is an NT4 domain.
User "XYZ" is a member of domain "B"
Groups "Apples" "Peaches" "Pumpkin" and "Bananas" are in "B"
and user "XYZ" is a member of all of these groups.

User "XYZ" logs onto workstation "123" into domain "B". I verify that kix is being run from a DC in domain "B". In the Kix token cache it lists the following domain\group enumeration:
A\Apples
B\Peaches
B\Pumpkin
A\Bananas
As long as the cache enumerates the group to domain "B" those scripts process correctly. If kix enumerates the groups incorrectly back to domain "A", it doesn't process the scripts.

The caches should be:
B\Apples
B\Peaches
B\Pumpkin
B\Bananas

So kix somehow cross checks the workstations domain for identical groups of the users login domain, and if there's a match, it incorrectly caches it as a group from the workstation's domain.

Make sense? Is this a known issue with a solution?

Thanks.