I may have found a bug with the MS Logon plugin. There isn't all that much to explain, really. The plugin doesn't seem willing to authenticate a user that belongs to a domain group that has been nested inside other domain group (the non-nested group being the group that is added to the New MS Logon ACL).
For example, say I create a domain group called VNC Users, and add an existing domain group called Help Desk to it. Next, I open the UltraVNC settings menu and in the Security tab add the VNC Users domain group to the New MS Logon ACL. When I try to log in with a user account located in the Help Desk group, I see an authentication failure.
Next, I take the domain user account that I previously tried to log in with and add it directly to the VNC Users domain group. Now, I am able to log in with the user account without any problems.
In short, UltraVNC doesn't seem to be able to support nested groups.
I hope that this helps somehow!