Access Policy on AD Group Membership does not work