NOT memberof ? deny auth based on AD group membership?

I would like for all AD users to have wildfire access except for those in a particular (blacklist) group.

Is there a way to negate memberof in a searchfilter?

Thanks

-P

This seems to do the trick: