Sonicwall Capture Client 36 does not handle AD users configurations well

We are looking for a discussion regarding the current Sonicwall Capture Client 3.6.28 cloud based threat protection and web filtering product. We have deployed in about 15 users and after some difficult tweaking figured out the best configuration for our needs.
- Here is the big issue. We are using Dynamic Groups that base the content filtering on the AD user logged into a workstation on the network. We create AD groups and add users to them. If upon login to the workstation,the SW CC setup matches the AD group, the specific policy is assigned.
- What is not working: the first time a user logs in, it picks up the correct policy. If another user logs in after that, it applies the previous policy giving incorrect access to the current user. We started on Version 3.6.26 and were promised a patch to correct the issue. 3.6.28 was released today but did not correct the issue.
- Sometimes, we can go to the group settings in the capture client admin system and refresh and the AD groups resync but this rarely works.
- I am hoping someone out there has this product and understands our situation - perhaps with some insight to get this corrected.
Thank you
Wayne