What are your group settings for the ACS group that links to Active Directory?
Try changing the group settings of your Everyone Group that maps to your ACS group to not have Exec / Priv 15.
Add an additional mapping for AD_Admins to map to a different ACS group that has Exec and Priv 15. That should do it.
Hope this helps, rate if it does,
JB
