The script works for the most part as it should. The only problem we have found on our TS server is that as soon as a client is known "too long" on the server, the automatic role assignment does not work. It is not a rights issue because a newly created user with admin rights gets the group but an old user does not.