It looks like your login page saves the session variable with a name: GroupID
But your Administrator rule checks the session variable with the name: UserGroup
That's why it never passes. You would have to change one or the other so they are in sync.