With the nesting of AD groups I've seen flaky behavior using such methods. One workaround that we've used is to take the Windows groups and make them members of the appropriate database roles and then look against the database roles themselves.