3

This is similar to the issue asked here in SE before Why are user permissions set in AD not updated immediately to SharePoint? but in my case it doesn't work.

I have a SharePoint 2010 Enterprise Portal. Authentication mode is Claims based with NTLM. We have also published the portal via TMG.

I noticed something weird with Active Directory Group membership that doesn't update immediately in SharePoint when a user is removed or added to AD Group.

I have setup a SharePoint Group and added the AD Security group inside this SP Group. Users are added and removed via AD Security Group. I have setup publishing page with unique permission with members in SP group can only access. When I add a user in AD it doesn't get immediately reflected in SharePoint. As mentioned in SE article above it take 24 hours to update.

I ran this command to set the value to 1 minute(as mentioned in the post above) but no luck. But if I add the users directly to SharePoint Group it works immediately. There is something strange with Active Directory and SharePoint Synchronisation.

stsadm -o setproperty -propertyname token-timeout -propertyvalue 1

IISRESET

If I do a IIS Reset then the user permissions are properly updated. I have also set the User Profile service to run every 30 minutes(Incremental update).

Additional Info: The AD group scope is "Global" and group type is "Security".

Does anyone come across similar issue and fixed it?

Additional references

http://technet.microsoft.com/en-us/library/cc287917(office.14).aspx

http://sharepointhacker.com/?p=50

http://answers.flyppdevportal.com/categories/sharepoint2010/sharepoint2010setup.aspx?ID=7ca0d88e-4de0-4aad-99a9-e7d56219f35d

1
  • i think this problem might happens with parallel reasons in some cases so make it difficult to troubleshooting . i describe that in this article sharepoint.stackexchange.com/a/201572/5170 if your admin account in sharepoint and active directory is the same you dont have this problem Dec 5, 2016 at 19:55

2 Answers 2

2

The workaround is mentioned in this article.

http://www.itunity.com/article/authorization-failures-claimsbased-authentication-sharepoint-2010-2839

You need to use the SharePoint Management Shell on the server, and run the following script:

$sts = Get-SPSecurityTokenServiceConfig 
$sts.WindowsTokenLifetime = (New-TimeSpan –minutes 60) 
$sts.FormsTokenLifetime = (New-TimeSpan -minutes 60) 
$sts.Update() 
6
  • the link is no longer availble
    – Supermode
    Nov 20, 2015 at 0:28
  • @Supermode it seems Scot Hillier has moved his blog. I'll try to find the article. Nov 23, 2015 at 1:12
  • @Supermode I have updated the link. Nov 26, 2015 at 2:31
  • 1
    This is a poor answer because when that link dies, the answer is no longer available. You should add the meat and gravy of the answer into your post! I see this has already happened once! I will edit your answer and add in the useful powershell script Jun 21, 2017 at 8:31
  • 1
    Yup, indeed. This is I believe the normal practice. Jun 28, 2017 at 11:36
1

For me the solution was simply to have the user (that was added to the AD group) to log off and on again on his workstation. That updates the group membership.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.