Not sure if it helps, but my experience requires a couple resolution steps. After starting this thread we did end up creating a rule as described above. Here is the catch, if a user or machine is moved to a different OU in AD, we have to remove the machine and/or user from the firewall rule, publish (not push) the policy and then add the user or machine back - then publish and push policy. This happens often, especially when there are name changes. My guess is you have a machine in an AD group, it is blocked, the machine is removed in AD but still shows up in the rule. I might remove your AD group, publish, add the AD group back, publish and push policy. Note that I am no where near an expert...... and this potential fix is what I would try.