allowed users AND allowed groups is working with this code. Allowed users is checked first, then if not explicitly in the list the group membership is checked.

To allow all users I would use 'Domain Users' as a group