The groups are new they were just created. I have a windows 2003 R2 server. I inserted the new server into an existing W2K domain (did adprep). Don't think that should be an issue. I am not sure how to check the users group token cache??