Basically you have to include the AD Groups in the user profile sync connection.
In User Profile Service Application "UPSA" under user profile sync connection
add new connection to AD.
You need to add users and ad groups.
☑ OU Name
✓ OU Name
✓ OU USERS
Look out for green checkmarks(✓). They need to be connected to OU.
For exapmle OU>Users and OU> AD Group1>Group Name, all need to be connected (checked with green checkmarks).
How to use Active Directory groups with workflows?
Add application pool account to group “Windows Authorization Access Group” in Active Directory (Under Builtin).
If the users participating in the workflows have been added to the SharePoint site via Active Directory groups, SharePoint has to update the user’s security token periodically by connecting to the domain controller. By default, the token times out every 24 hours. But if the application pool account did not have the right permissions on the domain controller to update the user’s token, user will keep getting the access denied error. The error was intermittent because when the user browsed to any page other than the workflow form, the token was getting updated successfully.
You can try to fix it through granting the application pool account
the appropriate permission by adding the account to the group “Windows
Authorization Access Group” in Active Directory.
After that run:
1.Sync User Profile Service Application > Start Profile Synchronization(Full).
2.Full/incremental crawl (Central Administration > Manage Service Applications > Search > Content Source) - sps3://YOURSITE