Hey there Graham,
I'm going to assume that you will cover this also when you open a ticket with us to work on your other items. From what you are describing here, it is looking like possibly a permissions issue of the user account running the ACUWizard.
Yes, I can mention this at the same time as the other queries. Yeah I also wondered if it was a permissions issue so I've been testing with various accounts including domain administrators, etc but still no joy. It also doesn't appear to matter if the group is a universal or global. Like in the example in the SCS guidance we need to add the client to the security group which authorises it against our radius server for 802.1X when the machine is powered down.