Here is the scenario – you have AD security groups specifically to DENY services to users that are added to this AD group. For example – a naughty user could be placed on probation in your organization, and then added to this group – in turn this membership would be automatically disabled in Lync.