I think I may have it. This server is replacing an old domain with a new one, but the NT4 PDC on the old domain is still connected to the network (still pulling data off). Is it possible that domain controllers for two different domain on the same network could cause this problem? Both servers have identical users & groups.

I searched on this problem and found another thread that had ingroup ("domainname\groupname") in sample code. I tried inserting the domain name into the argument, and it seems to be working much better.