The answer is

Pre-Windows 2000 compatible access Security group.

Quote
"@primarygroup can be defined only when an NT4 upgraded user is a Domain Admin."

I added them all to this built-in, and then had to wait for it to get around, but once the domain refreshed the script runs great! [Big Grin]

My first domain upgrade is a success! Thank you all for your input. KiXtart.org is my hero!