8200v Zone Assignment Question

I feel like I'm banging my head against the wall with this configuration.

I want to limit access to the appliance by domain membership. I create an Endpoint device profile that includes my domain, I assigned that domain to a community and membership in that community is determined from an AD security group. When I log in from a domain machine, I always end up in the default zone. It seems like I am placed in the default zone no matter what I do. Has anyone made this work? I can't find anything in the logs that even gives me a clue as to how the zone assignment is failing.