*n00b eaten*
Point taken. My main desire is to be able to rely on the script to accurately check members of groups. If the script is able to do this, then I would not need to flush the token cache.
So... I guess what I will have to do is, when a machine is found to not have the particular piece of software installed, I will manually flush the cache.
Or maybe I can put in a counter of some kind and flush the cache every Friday or something.

I cannot rely on flushing the cache when groups change, because groups by nature are ever changing.

Comments?
Thanks Les.