I recently installed SharePoint 2016 onto a VM and have a SharePoint site running. I am trying to use Active Directory Security Groups to give permissions to users. Some Security Groups are working as intended; I add the group to the designated SharePoint group and it gives the users the correct SharePoint permissions. However, some Security Groups are not working as intended; We add the group to the intended SPG and they are not allowed access: "Sorry, this site hasn't been shared with you". If I manually add a user from the Security Group, they are given access to the site. Has anyone run into this issue before? We have tried creating a new test Security Group and the users in that group do not get permission when added to SP. Would manually adding them via Powershell be a work around? Is this an issue with Active Directory?

1 Answer 1


I would verify everything is properly updated after an access change. There can be delay between adding users to the AD group, adding the AD group to the SharePoint group, and the SharePoint group "knowing" who belongs to that AD group.

Also, caching at various stages in that process could be affecting you here as well. Close the browser completely before each test (ensure there are no tabs open).

If you wait, say, an hour, or a day, does it resolve itself? You shouldn't have to wait this long, but if it does resolve eventually, it's likely a timer/caching/sync/replication issue.

  • Other than waiting, is there something that can be done to force this?
    – kevorski
    Jul 25, 2017 at 17:58
  • For replication issues, force replication on your domain controller (if you have more than 1). Oops, hit enter... ok so... for other issues you need to run the timer service that correlates. I don't know offhand which one handles which, but if you dig around in central admin timer jobs you might find one that looks promising.
    – Chad
    Jul 25, 2017 at 18:00
  • Also, try running a user profile sync. Incremental should be fine.
    – Chad
    Jul 25, 2017 at 18:02
  • why would it work instantaneously if I add a single user as opposed to a security group?
    – kevorski
    Jul 25, 2017 at 18:06
  • So I believe the way it works is it caches the user "token" which contains a list of AD groups that user has access to for a certain period (several hours potentially). If you log in, the token is generated and cached, then you change access groups around, the old token is still being used. For direct user access it doesn't need to check a token, it just verifies the user object directly.
    – Chad
    Jul 25, 2017 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.