I'm thinking this might have something to do with domain trust and pass-through authentication, etc...

I would go back to basics and start small - set up local workstation accounts and add them to local workstation groups - get that to work - then add domain users to local workstation groups and check for that... keep building until something breaks....

Don't bother trying to debug Win9x until you get WinNT working (eliminate KXRPC as a problem source )...

What kind of domain structure do you have ? Are you workstations joined to the logon domain or are they joined to a resource domain ?

Shawn.