In Thread 84541 there is a quote from Ruud
Regarding the AD Compuer Groups part:
Well, this is on the todo-list, but it's not as easy as you might think: KIX32 runs in the security context of the user, so it can't just use the computer token to retrieve group information. The only way to get at any information on the computer account is to query Active Directory, and this can become really expensive, considering the Universal and nested Global groups. I'm looking into the options, but I can't promise anything yet.
When kix32.exe or wkix32.exe is used in startup or shutdown scripts, it runs in the security context of the system account (the computer). So I would think the computer token can be used to retrieve group information.