BOE 3.1, Windows AD, NTLM not resolving groups via VM

Configuration:

64 bit Windows laptop (LT) hosting a VM POC sandbox (BOE), running BOE 3.1, attempting to connect to the host AD with NTLM.

Host has AD with groups HQ containing user hq1 and DEPT containing user dept1. DEPT is a member is HQ.

VM ( not VMWare but Microsoft) BOE is where CMC is running. In the CMC, I can authenticate to the AD DC with the Administator login. User hq1 can log into the BOE VM successfully using the AD. Can ping the host from the VM. But EVERY attempt (many forms and groups) to look up and resolve a group gets...

"winSec plugin failed to look up the account for the group...."

No spelling or caps issues going on ....

Any thoughts or info you may have to resolve this is welcome....thanks much.