Scom 2012 Sp1 Monitoring AD Groups Event Based

Hello All

I try to monitor some special AD groups (Domain Admin) and also others admin groups.

I followed some older blogs from technet and some mvps. 

http://blogs.technet.com/b/wchomak/archive/2009/01/07/general-security-auditing-group-membership-change-notification.aspx

https://blogs.technet.com/b/klince/archive/2011/05/18/how-to-configure-scom-to-monitor-for-changes-to-the-domain-admins-group.aspx

http://blogs.technet.com/b/kevinholman/archive/2009/02/25/authoring-rules-for-windows-2008-events-and-how-to-cheat.aspx

My problem is, when I set the filter for the domain admin groups with "Parameter 3" I didn't recive any events/alerts in scom. But when I set the rule only for the event id 4728 it works without "Parameter 3" and Event Source Security, I will recive all changes from any global group in the domain.

Thanks for help