In the Add/Edit Active Directory Grouping page of the OfficeScan web console, parent AD computers are selected automatically when users select all its child AD computers. As a result, parent AD computers will also be added to the AD Grouping rule with all its child AD computers.

To resolve the issue, you need to know that parent AD computers will not be selected automatically when users select all the child AD computers in the Add/Edit Active Directory Grouping page of the OfficeScan web console.

In short, add the top layer AD group to fix this issue.