Are you sure the user is in the group? Did you rename the group at some point? Check the user's group token cache in the reg. Try flushing the cache.