problem with ldap group

hi

i've setup a domain controller, and a group with a filter

when i look at the group results, i see all the users in the group, that's fine

in the fortigate i have the remote user group connected to the fortiauthenticator as a radius server.

the result is that i can connect using any domain user, not just the ones inside the ldap group

i must be doing something wrong somewhere, but not sure what that is

any ideas? thank you