Hmm that is interesting. When I look at the block in LogINsight though I see traffic getting blocked from the VM that I'm logged into with the AD group to the destination VM.

let me test that and I'll get back with you.