Long adding users to the group in Windows Server 2022

[Darvin1705]

Hello friends

I have probably a trivial problem for you guys, but I have no idea how to speed it up. 

I'm creating a new group in AD (Global - Security). I am adding a user to this group. The problem is that the supposedly user is already in this group, but the rights resulting from membership in this group only after a few hours. That is, if I give permissions for this group to browse some directory. It is after adding a user to this group that I have to wait a few hours until the user can browse this directory. When there were only a few groups on the server, it worked quickly, but when I have 20-30 groups in AD, it works slower and slower.

Sorry for my english. Thank you in advance for your help.

edit. The gpresult /r command on my computer tells me that my account is not yet in the group. In AD, I added my account to the group a few hours ago. I still have to wait.

[#2 · Accepted solution]

Group Membership is only evaluated on logon. So, if you change the membership of a user (or a group the user belongs to), you must tell the user to logoff and logon again. Afterwards he should immediately have his new permissions.

[#3]

Thank you for your help 🙂

[#4]

It sounds like you may be experiencing a delay in group policy propagation. Group policy is used to distribute security and other settings to computers and users in an Active Directory domain, and it can take some time for changes to propagate throughout the network.

To speed up the process, you can force a group policy update on the computer where you are testing the group membership. You can do this by running the "gpupdate /force" command in an elevated command prompt. This should force the computer to update its group policy settings and recognize the new group membership immediately.

If the user is logged in and you don't want the end user to perform GPupdate then push it from DC, Right click on the OU where the group policy is created then you can see 3rd or 4th option for GPupdate, click on it.

Note: if you have more than 10 DC then I would say not to run because it will reduce the network bandwidth by refreshing the GPO's and sysvol access over SMB port.

[#5]

Hello! It sounds like you're experiencing some delays with group membership updates in Active Directory. Here are some potential solutions to help speed up the process:

1. Check replication: Ensure that your domain controllers are replicating properly. If one domain controller has the updated group membership but the other does not, then users connecting to the slower domain controller may experience delays in accessing resources.
2. Enable group caching: Enable group caching on your client machines so that they don't need to query the domain controller every time a user logs in. This can help speed up logins and access to resources.
3. Reduce the number of groups: If you have too many groups in your environment, it can slow down the process of updating group membership. Consider consolidating groups or reorganizing them to reduce the total number.
4. Increase the group membership cache refresh interval: By default, the group membership cache is refreshed every 2 hours. You can increase this interval to reduce the frequency of updates, which may help reduce the load on your domain controllers.
5. Monitor performance: Use performance monitoring tools to identify any performance issues on your domain controllers or network infrastructure that may be contributing to delays in group membership updates.

I hope these suggestions help!