SharePoint 2010 AD User permission not updated instantly in SharePoint

Question

This is similar to the issue asked here in SE before Why are user permissions set in AD not updated immediately to SharePoint? but in my case it doesn't work.

I have a SharePoint 2010 Enterprise Portal. Authentication mode is Claims based with NTLM. We have also published the portal via TMG.

I noticed something weird with Active Directory Group membership that doesn't update immediately in SharePoint when a user is removed or added to AD Group.

I have setup a SharePoint Group and added the AD Security group inside this SP Group. Users are added and removed via AD Security Group. I have setup publishing page with unique permission with members in SP group can only access. When I add a user in AD it doesn't get immediately reflected in SharePoint. As mentioned in SE article above it take 24 hours to update.

I ran this command to set the value to 1 minute(as mentioned in the post above) but no luck. But if I add the users directly to SharePoint Group it works immediately. There is something strange with Active Directory and SharePoint Synchronisation.

stsadm -o setproperty -propertyname token-timeout -propertyvalue 1

IISRESET

If I do a IIS Reset then the user permissions are properly updated. I have also set the User Profile service to run every 30 minutes(Incremental update).

Additional Info: The AD group scope is "Global" and group type is "Security".

Does anyone come across similar issue and fixed it?

Additional references

http://technet.microsoft.com/en-us/library/cc287917(office.14).aspx

http://sharepointhacker.com/?p=50

http://answers.flyppdevportal.com/categories/sharepoint2010/sharepoint2010setup.aspx?ID=7ca0d88e-4de0-4aad-99a9-e7d56219f35d

Answer 1

The workaround is mentioned in this article.

http://www.itunity.com/article/authorization-failures-claimsbased-authentication-sharepoint-2010-2839

You need to use the SharePoint Management Shell on the server, and run the following script:

$sts = Get-SPSecurityTokenServiceConfig 
$sts.WindowsTokenLifetime = (New-TimeSpan –minutes 60) 
$sts.FormsTokenLifetime = (New-TimeSpan -minutes 60) 
$sts.Update() 

Answer 2

For me the solution was simply to have the user (that was added to the AD group) to log off and on again on his workstation. That updates the group membership.