Bryce, I think some accounts might end up with an extra \ in them (a few do on my accounts). But anyways. You could also run code to extract all the current members of the mail group and one from all users and then run a for each to add those not in mail to the no access group.