Are there any diffs between the privilege or permission_path when you run this against each principal?
EXEC sys.xp_logininfo
@acctname = 'domain\user1',
@option = 'all';
EXEC sys.xp_logininfo
@acctname = 'domain\user2',
@option = 'all';
EXEC sys.xp_logininfo
@acctname = 'domain\user3',
@option = 'all';
EXEC sys.xp_logininfo
@acctname = 'domain\group',
@option = 'all';
There are no special teachers of virtue, because virtue is taught by the whole community.
--Plato