Web Control - Group SID not blocking for Domain Admins

[whitelistCMD 1]

Hello,

ERA OVA version 6.5.417.0

We currently use ESET Web Control for Web Filtering. We've been adding each individual user manually, but we're trying to move away from that and just use group SIDS. The rules are already in place and we've had no issues with blocking. If I add the group SID for Domain Users to our default category block rule, I can then remove the users individual SID who belongs to Domain Users group, and ESET Web Control is still blocking as it should.

However, if I add the group SID for Domain Admins to the same default category block rule and remove an individual SID who belongs to Domain Admins group, ESET Web Control is not blocking. I've gone through the rules and verified that they are in the correct order and the sites are not being allowed in an earlier rule. So far, this seems to be the only group SID that does not pickup the active block. Any thoughts or ideas as to why this might be? Thanks in advance.