Active Directory group issue

We are in the process of implementing AD in Ignition, we have been doing user testing which was going fine until we encountered a strange issue. Users who have our AD group called ES-HMI-USER which should equal to our Viewer role in ignition. But these users are getting a FORBIDDEN ACCESS screen. I have the security levels in place and have confirmed the project properties are set right, but I am stumped on where to look next to help identify the issue. All the other groups we have seem to work fine. Any help would be appreciated. Thanks!