Active Directory

I have AD users with the "servicedesk" group who get into SD via import, but if I take the yuk group from the user in AD, the user can still log into SD.
How can I prohibit an AD user from logging into SD if he is not in the "servicedesk" group?