SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I have an AD group called domain\Group1, in SharePoint I create a group called Group 1. In the SharePoint group I add the corresponding domain group. Now if I add a user to the domain group, shouldn't that user have access to wherever the SharePoint group have access or does the UPS have to be set up for this? I don't won't to write back to AD or anything, just grant users access.

Thanks in advance.

share|improve this question
Is your active directory group security enabled? It should be since you were able to add it to the SharePoint group... – Kit Menke Sep 3 '13 at 17:13
There also could be an issue with UPS configuration when you selected not all AD DS containers or make some custom selections in your connection properties. – Mikhail Jun 29 '15 at 12:51

Late answer but, The User Profile is not responsible in this case.

SharePoint recognizes AD security groups and attaching permissions to these groups will cause the permissions to be granted to the User.

Unfortunately, due to SharePoint caching the user's memberships on login, changes made to a security group are identified only after the cache has expired, possibly taking as long as 10 hours (by default) for it to happen.

This causes the unexpected behavior of adding a user to a Group and the user still being shown the access denied or lack of interface feedback related to the new permissions he should have received.

The user not having his tokens cached prior to being added to the group would cause him to receive access immediately.

Serge Luca's Blog

Viorel Lftode's Blog

share|improve this answer

Instead of changing the STS configuration as suggested in the blog posts, I'd suggest to just clear the Logon Token Cache.

Clear-SPDistributedCacheItem –ContainerType DistributedLogonTokenCache 
share|improve this answer
Old post, but justed wanted to drop my 5 cents. I completely agree with Michael Schau. While you can set the token expiration manually, this can have unwanted side effects. I did it in a bi portal I've been working on and suddenly users were no longer authenticated on the SSAS cube. Needless to say, this is unwanted in a bi solution :) – user306393 Feb 13 '15 at 10:22
If you reset IIS, you should expect logins to be reset, because you just reset the system people are logged into. – user2658412 May 26 '15 at 16:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.