The SP Visitors group has an AD group with permissions. Users that already existed in the group when it was added have permissions but users that are added to the AD group afterwards don’t have permissions (check permissions shows they have no permissions and they can’t access the site). This is SP 2013 claims, so I found this post: http://sergeluca.wordpress.com/2013/07/06/sharepoint-2013-use-ag-groups-yes-butdont-forget-the-security-token-caching-logontokencacheexpirationwindow-and-windowstokenlifetime/

I set the WindowsTokenLifetime to 2 minutes and the LogonTokenCacheExperiationWindow to 1 but I don’t see any difference. Any ideas?

  • Does it work after a delay (like the day after) or recycle? Mar 7, 2014 at 5:28

1 Answer 1


That was silly of me. The changes didn't take effect until we did an iisreset! Once that was done, the token starting expiring and refreshing. The problem is fixed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.