I've removed a user from an AD group, though check permissions are still showing them as having permissions due to that group.

I'm aware of WindowsTokenLifetime, but that is set to 10 hours, while the check permissions are still wrong after 16 hours.

Is there a different token that expires on a different schedule? At what point will check permissions show accurate data after a change in windows group membership?

This is SharePoint 2019.

  • Has the user accessed the SharePoint farm since the membership change?
    – Greg W
    May 30, 2020 at 10:12
  • No. Not yet. I expect that would get a token refreshed, but I'd also like to ensure that IT can correctly say who has access.
    – Mike2500
    May 30, 2020 at 18:58
  • Have a read of docs.microsoft.com/en-gb/archive/blogs/sambetts/…
    – Greg W
    May 30, 2020 at 23:42
  • That article states 24 hours for non-interactive logins, and 1 hour token cache for interactive logins. Then what's the WindowsTokenLifetime that's 10 hours?
    – Mike2500
    Jun 1, 2020 at 13:10
  • 1
    Different caches for different purposes I believe. The WindowsTokenLifetime is for the security token service which is not used for the “Check Permissions” functionality. Note that while “Check Permissions” may not show correct group membership, the Security Token Service will still correctly enforce the current group membership (assuming the user has logged off/on since the membership was updated).
    – Greg W
    Jun 1, 2020 at 22:32


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.