The user doesn't need to belong to a group...based on what you mentioned in your message, is it possible you have conflicting records in the mmsecure table? I recommend opening up MMSecure.dbf to see what you've got!
Regards,
Kevin McNeish Eight-Time .NET MVP VFP and iOS Author, Speaker & Trainer Oak Leaf Enterprises, Inc. Chief Architect, MM Framework http://www.oakleafsd.com