This problem in last month is a major threat for us and big mistake but these solutions impacts depend on your chance...
- hasn't any relation to UPS (user profile service) (dont waste your time for that)
- token timeout is a good solution in many cases in delays on apply change in 2010 or 2013 but major reason may in number 3
$sts = Get-SPSecurityTokenServiceConfig
$sts.WindowsTokenLifetime = New-TimeSpan -seconds 300
$sts.Update()
$sts = Get-SPSecurityTokenServiceConfig
$sts.LogonTokenCacheExpirationWindow = New-TimeSpan -Minutes 10
$sts.Update()
- Create an Organization Unit (OU) in the Active Directory (AD) and delegate Full Control rights to SharePoint Service Account (Central Administration Application Pool Account) source : here and here
if your users and groups all in one OU (organizational unit) and sharepoint admin account is diffrent from domain admins this solution in this link is only one solution/way for your problem.
this means sharepoint service account couldnt possible to access to user/groups information and their new membership so sharepoint has no permission to access to your new updates but for your new users applied before first login to sharepoint.
Why SharePoint 2010 or sharepoint2013 Check Permissions Can Give Wrong Results for AD Groups in this article also we have this problem
