Firepass 7.0 Inconsistently returning groups from AD

We just did an AD upgrade to 2008. It seems that since we have done so, that when a user logs on they do not always get all of the resources for the groups they are a member of, and sometimes it returns all of them or if it finds nothing, denies the logon.

 

 

I have tried putting our Global Catalog server directly in the Kerberos server field both by name and IP, with the same results.

 

 

 

I am working with support on this, but I thought I'd give it a try and throw it out here in case anyone else has had a similar experience.

 

 

 

Thanks!