This message was deleted.

Figured it out! Used ControlUp to run a gpresult /z in the user session, and determined that one of the groups to which she belongs is nested in one of the excluded groups. Remove the nesting, problem solved!