AD Nested Groups not always receiving permissions

Question

We have multiple domains in our forest. We use Universal Security Groups for our department names, and Universal Security Groups for job titles. Within the job titles group is where we list the individual users.
Every once in a while, we will have an instance where a user is a member of their job title Universal Security Group, which is a member of their departmental Universal Group, but cannot access a share, even though that departmental Universal Group has the correct
permissions assigned on the share. Furthermore, another member in that same job title group can access the share.
The only fix that I have found thus far is to add the user directly to the share's permission.
Has anyone come across this before? Like I said, it only happens every so often, but I have yet to find an explanation for it.
Thanks

Answer 1

Good info Al - 
Do you have an article to reference the best practice you mentioned?  Just to clarify, anybody that was not specified in the share's security would inherently have Full Access?
I believe that this can be resolved, although I am not sure if it was just time that fixed it.  I removed the user's specific access and left their group membership permissions alone, and all is well.
Thanks!
That sounds like a replication issue...
Best practice links:
one, two,
three.
Share permissions are a holdover from FAT32 which had no security at all. In addition to what you will read at those links, consider what share permission would be required to a share containing an application folder of files that require only read
access and a data folder of files that need to be modified when the user runs the application? Answer: share permission needs to be change or unlimited. But then you would need to apply differential NTFS permissions to make the application files readonly.
Al Dunbar -- remember to 'mark or propose as answer' or 'vote as helpful' as appropriate.