It sounds like what you want to do is roll up your AD groups into
application-specific role descriptions.  For example, you might want to put
domain\admins1, domain\admins2 and domain\admins3 into a role in your
application call Administrators.

If that is what you want and you are using Win2K3 server for your web
server, the best thing to check out is Authorization Manager (AzMan).  It
allows you to build application specific roles, tasks and operations and map
them to users and groups at runtime.

You could also build something similar in ASP.NET, but you'd have to write
it yourself.  One thing you might do is write an HttpModule that examines
the WindowsPrincipal returned by the Windows authentication module and maps
the user name and Windows groups into application specific roles.  You would
then create a new IPrincipal object (probably based on the GenericPrincipal
class, but you can write your own easily if you want) that contains your
application specific roles.  Then, you would test against those roles in
your application instead of the groups directly.

Such a thing is more work, but might be worth it.  Unfortunately I don't
have a sample to point you towards.  However, the .NET role-based
authorization framework is very flexible and doing this kind of stuff is not
very hard.

Joe K.