Users are not enrolling in correct Group

I have HR OU containing HR employees in Active Directory running on Windows Server 2008 R2.

In Symantec Encryption Management Server 3.3.2 , i have created a group by the name of HR and under Membership tab i have checked "Match Consumers Via Directory Synchronization". Below are furher settings in it:

Attribute:memberOf                Value:OU=HR,DC=contoso,DC=com

Now when an HR user logs onto his computer on which Symantec Encryption Desktop is intalled and tries to enroll, he is placed in default Everyone group rather than HR group. Why is this happening? Can anyone help me out?