I spoke too soon changing the $domaingrp to "desktop admins" still reports "add group"