PassCore Server

• OS: Windows Server 2008R2
• Provider: Active Directory
• Settings file (without sensitive information):
  appsettings.json.txt

Describe the bug
The Variables in RestrictedADGroups and AllowedADGroups in
[IIS_ROOT]\PassCore\appsettings.json
aren't being honored. I can, without failure, change any domain-admin passwords I like (given I know the origianal PW of course), even though only the members of the AD-Group "ExternalUsers" should be allowed to update their passwords. Please analyse my settings an tell me if I missed something.

To Reproduce
Steps to reproduce the behavior:
normal use

Expected behavior
only allow users that are members of the AD-Group "ExternalUsers"

Screenshots
NOT APPLICABLE

Desktop (please complete the following information):

• OS: Windows 10 1903, Mac OsX
• Browser MS EDGE, Opera, safari in Mac OsX
• Version Windows 10 1903, Mac OsX 10.14.6

Additional context
Add any other context about the problem here.