Added AD group membership condition by Joseph Rafferty