Very interesting approach and a great write-up on a feature that is covered very sparsely. I have used this and made the usermods.bat file dynamically check AD memberships instead, which makes it easier for me/us to manage. If a user is a member of one of the specified ADs, they are in nolockdown, otherwise they will be in lockdown.

So thanks for the inspiration!