Zenoss Active Directory Authentication, Users permission is only default role

I am trying to switch my zenoss authentication from ldap to active directory. The Active Directory Authentication works but the users permissions are not correct. I have ZenUser as default role and everyone that logs in is a ZenUser but I see the correct permissions per user under the Cache tab next to the cached user. Does anyone know how to fix this

I have setup three different groups in active directory Zen_User, Zen_Manager, Zen_Admin and map them zenuser, zenmanager and manager roles. This worked fine in my ldap instance

Any ideas on what else to look at to fix this

I am running zenoss core 4.2.4