DO you know if when CRM was installed, the autogroupmanagement setting was set to off?
You can also check in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM\AutoGroupManagementOff
If this is set to 1, then you have to membership of AD security groups.
But you say you are getting the error on update of user record, what sort of update are you making?