I was under the impression IN GROUP does not require the KXRPC service if you are using it to associate with Global groups. If you want to associate it with Local groups on the logon server KXRPC service is then required.