You're write, jooel, however it gives an alternate means of testing: If you sit at a machine and do a "net user %username% /domain", it should tell you what domain groups the user belongs to. If that is functioning properly, then it's possible to get to the information.. if not then there are other issues.

Brian