When does the Endpoint Agent query the AD server for User Group resolution