What is your domain controller configuration like? I have personally found that if you're not waiting until replication is complete, the groups will not be consistent. Could this be an issue?

Brian