SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a SharePoint 2010 Foundation installation on Windows 2008 R2 and SQL Server 2008 and using Claims and Windows authentication.

Subsites are visible only to members of a certain group. However, when I add a user to the AD group that has access to a given subsite, the permissions for that user in SharePoint is not updated before the next day. So there is a mismatch between the permissions in AD and the ones in SharePoint.

For me, it seems like SharePoint is caching the permissions, and only updating them once every day. Is there a way to force a refresh so new permissions are loaded into SharePoint at once?

share|improve this question
All is explained here in detail:… – Manu Mar 11 '15 at 14:59
up vote 14 down vote accepted

Configure the Token Cache to a smaller value: Default is 1440 minutes (24hrs)

share|improve this answer
Great tip! I will try that. – azzlack Jun 18 '11 at 17:18
That worked beautifully. Thanks! – azzlack Jun 23 '11 at 21:23
I tried this but it doesnt work for me.… – Kannan Jun 17 '13 at 7:52


This may due to the fact that Sharepoint imports the group membership information from Active Directory on a regular basis. the Frequency depends on configuration of your User Profile Synchronization service in central Admin. Profile synchronization is described nicely here:

Updated Looking at comments below and carefully reading the link above, I think that AD Group membership is used for while Sharepoint compiled the target audiences. It is possible that even running profile synchronization does not solve your problem. Try using IISRESET /NOFORCE and see if it immediately detects AD changes (and clears the cache). I came across a long thread related to similar problem and I could not find a proper answer. Please share your experience and findings.

share|improve this answer
Great link Ashish! – Neil Richards Jun 15 '11 at 20:20
I answered a similar question a couple days ago about access with AD groups and got downvoted. AD permissions are tied to the profile import. I want my 2 points back Anders! – Eric Alexander Jun 15 '11 at 20:46
@PirateEric for once you cannot compare 2007 user profiles with 2010 since the architecture was changed completely with SP 2010 using FIM. Also read the article, it clearly states that groups are only used for Audiences, not authentication :-) – Anders Rask Jun 15 '11 at 21:13
gpupdate /force seems to work as well. – Colin Jun 16 '11 at 6:49
iisreset /noforce worked for me on SPS 2013. – NekojiruSou Apr 7 '15 at 3:38

Hope this will help someone because I faced the same issue. The claims based token is refreshed every 10 hours and hence if you make any changes to Active directory group memberships it won't reflect immediately in the token. you need to run the following powershell command to adjust the token life time to a smaller value.

$sts = Get-SPSecurityTokenServiceConfig
$sts.WindowsTokenLifetime = (New-TimeSpan –minutes 60)
$sts.FormsTokenLifetime = (New-TimeSpan -minutes 60)

It is explained in detail here

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.