A network administrator manages a Palo Alto Networks firewall in a datacenter. They have configured dynamic address groups (DAGs) to automatically include servers based on tags. The tags are assigned via User-ID from Active Directory. The administrator notices that some servers that should be in the DAG are not appearing, while others are correctly added. The firewall is configured to receive User-ID information from a domain controller via the PAN-OS Agent. The tags are correctly assigned in Active Directory. What should the administrator verify first?