A user changed group membership but still gets old permissions.
Kerberos tickets are valid for 10 hours by default. Group membership changes only take effect after a new TGT, so after sign-out and sign-in, or a ticket purge.
Try this first
- 1On the user's PC: klist shows tickets. klist purge clears them. Then klist tgt requests a new TGT, requiring a fresh AD round trip.
- 2Quickest fix: sign out and back in. Reboot is overkill but also works.
- 3For a service account running as a service, restart the service or it keeps using the old ticket.
- 4On replication lag between DCs: the change landed on DC1 but the user logs in via DC2 which hasn't replicated. Force repadmin /syncall if urgent.
- 5For file share access, SMB sessions also cache permissions. net use * /delete on the client can force re-auth.
When to bring us in
If a permission issue persists after re-login, check Universal Group Membership Caching, AD trust direction, and possible 'token too large' errors (user in too many groups).
See also
- One DC or two DCs for an SMB office?Two is almost always the right answer; one DC is a single point of failure for logon, DNS and GPOs.
- Should I split FSMO roles across two DCs?For a small domain all on one DC is fine; with two DCs splitting is tidier but not required.
- How do I know my AD replication is healthy?Replication errors creep in silently; they only surface when logins or GPOs misbehave.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.