Well after a little further testing I'm not quite sure why(still need to dig into the ADSI code further) but the first code example from the manual using KiXtart native EnumGroup appears to return many more groups then even the ADSI code does. EnumGroups retrieves even local groups on the workstation, and Distribution groups and even Special groups like: Pre-Windows 2000 Compatible Access

So if this script is run during logon, the native KiXtart enumgroup appears to be able to return many more groups overall.

When I get time I'll try to investigate what is up with the ADSI code and why it does not return all the same Network groups, I realize it won't return the local and distribution groups but would think all other Network groups should match. It does return some Universal but not others, not sure if that is due to some nesting going on or what.