Just a guess. Is it possible that %G is not assigned until you access a
share? %G is the group of the user in the share, not the name that the client
used to log on with (%U). It may be that there is no group assigned until the
user gets into a share.
Joel