Issue centralized datasource settings database

Hi all,

I have a question, hopefully someone can help me.
We use Jet Essentials 2012 with a centralized settings database.
This database is set up according to the instructions found on the jet reports knowledge base. For a long time everything worked just fine.
Until I needed to add 2 more data-sources.

These are data-sources that use the universal connector, in stead of the dynamics nav connector, like my other data-sources. Meaning that they use another authentication method. This method requires my users to check a box to use their windows credentials. And there lies my problem. In spite of the users having the right permissions on the settings database (they should be able to write user related settings to that database) they can't change the authentication setting for the universal connector data-sources. They get an error saying The Insert permission was denied on the object 'SharedDataSourceSettings'

One more thing, that's what causing my problem but I wonder if anybody else has had the same issues: the security on the server is controlled by AD groups. Hence: we have 2 AD groups, JetsettingsReader and JetsettingsAdmin. The first group contains users, the second group contains our designers who should be able to create/change and delete data-sources from the central database.
The JetsettingsReader group has the settingsreader role, that has insert permissions on the SharedDataSourceSettings table. Imho should my users be able to insert.
When I add a user directly to the security of the database and give this single user the settingsreader role, everything works fine.

Looks like my AD Group is the culprit, but I have no idea how to solve this. I can't find anything about AD Groups not working on the jet reports sites (kb or community). Even worse: in the 2013 version and up: you are able to attach an AD group to your centralized settings database…

Anyone ever had this problem? And how do I solve this?

And please don't tell me the obvious we already thought of but we don't want to do: attach single users and get rid of the AD group. That's not going to work for us :) Too much of a hassle ;)