File permissions not immediately updated at client machine (2008 Svr R2)

Question

When I add a user to a group on our server share, the changes aren't registered on the client workstation until the user logs off and then back in, am I missing something?

Details:
-Running Windows 2008 Svr R2 (64-bit).
-I have a file share, I have assigned permissions within the share via a group, I then assign users to groups and then put the user group within the permission group (nested groups).
-When I put someone into a group that should give them rights, or remove them from a group so they no longer have rights, the effect isn't immediate on the client computer. For example, if I add a user to a group, the files they now have rights to do not show up until they logoff and back on. ALSO, If I remove them from the group, they retain rights to modify files until they logoff and back on and the permissions are "updated" on the client workstation.

Am I missing a setting or am I doing something incorrectly?

Answer 1

This is standard behavior. When group memberships change the client has to pull a new security token, the changes are not reflected immediately.

It's not a workstation thing. It's a user thing. For the user to obtain the changes on any given workstation they need to log into that workstation AFTER the group membership changes have occurred. If they already have an established session when the membership change occurs then they have to log out and log back in.

It just occurred to me that you can do this without completely logging off if you are talking about changing local group memeberships on your server (and not domain groups memberships). You'd have to disconnect all network drives connected to shares on that server and then kill any share connections connected to that server, then remap or reconnect them all. It'd be easier to just log out and log back in.