Return
-
Title
Permissions Not Applied After Group Membership Change -
Description
In a scenario where an access template is applied to a group, those permissions will be applied to members of that group. When a user is newly added to the group, you may find that the user does not inherit the permissions for a while. -
Cause
A user's group memberships are stored in a user token. This token will often persist in most scenarios, such as a kerberos token persisting until the user logs out of their workstation and logs back in. -
Resolution
WORKAROUND 1
If connecting via the MMC and using the logged in user, do one of the following:
- Log out and log back into their workstation.
- Right-click on the Active Roles top node in the tree pane of the MMC and click Connect. Clicking Reconnect will not work as it reuses the existing token. On the Connect dialog, specify the username and password to connect.
WORKAROUND 2
If connecting via the Web Interface and the Web Interface is configured to use Integrated Authentication, do one of the following:
- Log out and log back into the workstation.
- Recycle the application pool.
WORKAROUND 3
Note: Always create a backup of the registry whenever modifying, adding, and removing registry entries.
If connecting via the Web Interface and the Web Interface is configured to use Basic Authentication, the default user token cache TTL (time to live) is 15 minutes. Do one of the following:
- Recycle the application pool.
- Modify the registry on the Web Interface host to lower the default TTL of the user token cache. Use the following steps to set the TTL to a lower value:
- Open the Registry Editor.
- Navigate to the following key:
HKLM\System\CurrentControlSet\Services\InetInfo\Parameters - Create a new DWORD with the following information:
Name: UserTokenTTL
Value: <time in seconds>
** Suggested value of 30 ** - Close the registry editor.
- Perform an IISRESET to load the new settings.
Option 2 will significantly decrease the time needed to wait before the permissions will be available for the account.