Jens,
I did create depta_priv depta_pub deptb_priv deptb_pub. And by using @primarygroup to pull the group names a user in dept A gets depta_priv and depta_pub and a user in dept B gets deptb_priv deptb_pub but if "b" user also belongs to the "a" group, but it isn't his actual dept then "b" user can map the depta_pub however "b" will not get the depta_priv drive mapped.

Howard,
I did get the @primarygroup to work. All of my upgraded NT users needed to be added to the "pre windows 2000 compatible access" built-in group. once I did that The script ran just like it should have.