It depends on what operating system your domain controllers are running. If some are running Windows Server 2003 (which it looks like because synchronization is working for some users) and some are still Windows Server 2000 then it would depend on which domain controller the user gets authenticated against. Check your event viewer under the Admin menu and see if you're getting the same error as above.

If you aren't getting that error then it could be a situation similar to the one I've seen here at work. The provider uses the pre-Windows 2000 group name which can be different than how the group shows up when you look in the AD. You can find the pre-Windows 2000 name by right clicking on the group and going to Properties. It should be listed on the first tab.

I apologize Oxiane but there's only so many hours in a day and with a full-time job and family commitments I haven't been able to dedicate time to completing the fix. That's not to say that I haven't been working on it just that it hasn't been completed.