Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I add a user to a group on our server share, the changes aren't registered on the client workstation until the user logs off and then back in, am I missing something?

-Running Windows 2008 Svr R2 (64-bit).
-I have a file share, I have assigned permissions within the share via a group, I then assign users to groups and then put the user group within the permission group (nested groups).
-When I put someone into a group that should give them rights, or remove them from a group so they no longer have rights, the effect isn't immediate on the client computer. For example, if I add a user to a group, the files they now have rights to do not show up until they logoff and back on. ALSO, If I remove them from the group, they retain rights to modify files until they logoff and back on and the permissions are "updated" on the client workstation.

Am I missing a setting or am I doing something incorrectly?

share|improve this question
up vote 3 down vote accepted

This is standard behavior. When group memberships change the client has to pull a new security token, the changes are not reflected immediately.

It's not a workstation thing. It's a user thing. For the user to obtain the changes on any given workstation they need to log into that workstation AFTER the group membership changes have occurred. If they already have an established session when the membership change occurs then they have to log out and log back in.

It just occurred to me that you can do this without completely logging off if you are talking about changing local group memeberships on your server (and not domain groups memberships). You'd have to disconnect all network drives connected to shares on that server and then kill any share connections connected to that server, then remap or reconnect them all. It'd be easier to just log out and log back in.

share|improve this answer
Correct. This isn't about the workstation, it's about the user. – mfinni Sep 2 '10 at 17:39
Is there a way to force the workstation to pull a new security token from the server? – yougotiger Sep 2 '10 at 18:58
@Yougotiger See my edit. – squillman Sep 2 '10 at 19:15
Thanks, appreicate your speedy response. – yougotiger Sep 2 '10 at 21:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.