In last month I have similar mistake and @mike2500 solution is a good solution for many people but not for me. and search in Google and results pages cant help us.
another parallel problem occur for us when we changed permission and try to test with different users-names and they report : not applying today. and applied after 10 hours and some other changes in user membership groups never applied but if you create new user and grant permission by adding to other groups this is applied only in first time
some users in OraganizationalUnit1 and other users and groups in Organizational unit 2 and when SharePoint can read OU1 and can't read OU2.
and this model occur if you have any other changes never applied.
and only one way that help us is
- change the value of WindowsTokenLifetime by this link
- try this:right click on OU and grant delegation (read users info) for service account that run application pools in IIS for your SharePoint.