The SP Visitors group has an AD group with permissions. Users that already existed in the group when it was added have permissions but users that are added to the AD group afterwards don’t have permissions (check permissions shows they have no permissions and they can’t access the site). This is SP 2013 claims, so I found this post: http://sergeluca.wordpress.com/2013/07/06/sharepoint-2013-use-ag-groups-yes-butdont-forget-the-security-token-caching-logontokencacheexpirationwindow-and-windowstokenlifetime/
I set the WindowsTokenLifetime to 2 minutes and the LogonTokenCacheExperiationWindow to 1 but I don’t see any difference. Any ideas?