I have a SharePoint site collection that has no direct user permissions set, we have a policy where users are added to a specific AD group to get access to different areas, your classic Role based security using AD.
What I am finding is that if a user is removed from an AD group they will still have access to the site and items. I am aware of the token timeout, which I have reset. I have also done an IISRESET, and restarted the server last night.
If I perform a check user permissions, SharePoint keeps telling me that the user has access via the AD group. Yet I have looked at the group on AD and the user is not a member.
The user was removed from the group a month ago as they moved departments but they can still access their old department's content, which is not allowed.
Anyone else got a trick or two I can use to ensure that SharePoint validates the AD group membership correctly.
I know there is an issue with claims-based auth, but we are using classic.