the group is set to an AD group (I think) called allStaff. My understanding is that everyone is a member of this groupThis doesn't inspire much confidence. Are you SURE the problematic user is in this group?