Invalid AD Groups

All,  we have experienced where bad or no longer valid AD groups are in users.allow,  this negates authentication across the board.  Version 4.1 QAS.  Is this by design?  Is there a stanza in vas.conf that can bypass any bad entries?

Thanks,

Scott