Per support from Centrify:
The issue you are describing is a known issue with the express version. It doesn't happen in the licensed version of the product because groups are handled differently
So I wasnt imaging things nor do I have anything misconfigured.