Restrict Internet Access for 1 user or 1 group

[ngtri]

hello everyone
I have 2 Windows 2003 servers.
1 is AD server and 1 is ISA 2006 server standard edition

The ISA is a domain member

I need to block access to the Internet for 1 user or 1 group of users without effecting any other users or groups.

I looked at different policies and I found a way to block 1 user by searching the new user from the AD. I created a new policy
Name: Block 1 user
Action: Deny
Protocol: All Outbound Traffic
From/Listener: Internal
To: External
Condition: 1 user and removed All Users

I log in with other users for testing. It did not work. All users have internet access denied.

If I removed 1 user with All Users of the condition and then it worked fine
Any idea's?

Thanks