An AD security group can be set up with a provisioning group and targeted so it is not archived, follow steps below:
1. Using the Enterprise Vault Administration Console, create a new Provisioning Group, targeting the AD Security Group in question.
2. Deselect "Archive mailboxes in this provisioning group" located in the General tab.
3. Change the provisioning priority so that this new group has a higher priority than all other Provisioning Groups permitting archiving.
4. Run the Provisioning Task.