Send Access-Reject when user does not match any group?

Hi, Is there a way to configure FreeRadius 2.1.10 to send Access-Reject on users which don't match any of the defined groups? I tried with: DEFAULT Group-Name !* "", Auth-Type := Reject Reply-Message = "Account rejected.", Fall-Through = No and DEFAULT Group !* "", Auth-Type := Reject Reply-Message = "Account rejected.", Fall-Through = No as the last and only rule in "users" but it isn't working, freeradius still sends Access-Accept, even if the user does not match any groups. Thanks!