Handling licenses and Excluded group in PGP Universal Server

I have PGP Universal server with PGP desktop 10.2.1.  I am trying to figure out the best way to move users to the "Excluded" group as they leave the company and are deleted from AD.   I am not an AD expert or even generalist.  Anyone have the best ideas for handling this.  I have tried a variety of "! memberOf" filters, but it does not seem to work.  Maybe I have the wrong criteria or wrong something.   Anyone done this (I assume many have) and what worked for you.

Thanks.