users.allow contains shortname of group instead of <domain>\<samaccountname> format to support cross forest authentication
<domain>\<samaccountname> format in users.allow was not supported before QAS 188.8.131.52
Manually edit the users.allow file to contain <domain>\samaccountname of the group
If the setting is being pushed out via group policy, ensure the QAS version installed is greater than QAS 3.2. We recommend the latest version of QAS to be installed.
* users.allow now supports group entries in <domain>\<samaccountname> format,
so when dealing with multiple cross-domain groups with the same
samaccountname, the correct one can be specified.