RADIUS AD Auth with NPS does not allow changes on WLC

[roger perkin]

I have a requirement to authenticate 5508 WLC users via NPS. 

I have set it up using this method 

http://blog.skufel.net/2012/06/how-to-integrating-cisco-devices-access-with-microsoft-npsradius/

And it works to the point that an AD user not in the correct group does not gain access to the WLC.

However once logged onto the WLC you are not permitted to make any changes. 

Authenticated AD users are being assigned shell:priv-lvl=15

So is NPS not setting the priv level to 15 or is the WLC is not understanding it correctly?

Has anyone configured this and made it work?

Thanks

Roger