You could be on to something... the NT provider might not be working as expected. Try using GetADUserGroups (it uses LDAP) and see if you get better results. The example in the header should be enough to find out if it gets better results....

GetADUserGroups() - http://www.kixtart.org/forums/ubbthreads.php?ubb=showflat&Number=198609#Post198609

How to use UDFs -
http://www.kixtart.org/forums/ubbthreads.php?ubb=showflat&Number=81943#Post81943

The rest of the UDFs are here -
http://www.kixtart.org/forums/ubbthreads.php?ubb=postlist&Board=7&page=1