I am creating new AD accounts on the fly in a workflow. Once created I call SPWeb.EnsureUser, then add the user to a SPGroup. If I browse to the group I see my new account in there. If I log out and try to log in as the new account (FBA site) it denies me access. If I give it about 15 minutes it'll let me in.

I'm guessing this is due to Active Directory propagation and updating the SharePoint servers. However, SharePoint sees the user account and the user is added to a group.

Is there a way around this? Can I force a refresh or tell SharePoint "trust me, this guy is okay"?

Thanks, David

  • IISRESET helped me with scenario like this.. not posting it as an answer because I am sure you don't want to go that way... Jan 6, 2012 at 2:30
  • 1
    Thanks, yeah, I can't roll services everytime a user is added. Jan 6, 2012 at 3:02

1 Answer 1


Figured it out!!

What I didn't realize was that my FBA ldap provider had the specific domain controller specified, and the DC is one sitting on a WAN. So it took 15 minutes for my local network DC to update the WAN DC. I updated my code to use that specific DC and I can log in immediately.

Woo hoo!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.