Permissions in AD not populating

Question

I have two environments both running SharePoint 2013:
1. My Dev environment
2. Customer production environment
I go through the following procedure to add users to security groups. In My development environment this works fine and permissions are assigned as expected. In my customer's environment I'm getting problems for the bold sections. It sometimes takes a week
sometimes a day for users to actually get permissions.
Create an AD group “MyADGroup”
Add a user “UserA”  the AD group
Create a SharePoint security group “MySPGroup”
Add MyADGroup to MySPGroup in SharePoint’s permissions settings
Check permissions on UserA -> permissions are supplied directly
Add UserB to the AD group
Check permissions on UserB -> permissions are supplied directly
Logged in as User B and I’m getting access to the site without any problem.
The problem only seems to occur when I add new people to existing AD groups. It looks like SharePoint doesn't apply the AD group changes. The time that we have to wait for the AD changes to be applied seems to be random as issues do disappear randomly (not
after a certain period of time and not always on the same day of the week)

Answer 1

The problem arises from the fact that SharePoint caches claims tokens, including tokens for groups.  So it can take up to 24 hours for a new user to actually get their permissions based on being added to an existing AD group.  This article explains
the issues:
http://sergeluca.wordpress.com/2013/07/06/sharepoint-2013-use-ag-groups-yes-butdont-forget-the-security-token-caching-logontokencacheexpirationwindow-and-windowstokenlifetime/
Paul Stork SharePoint Server MVP
Principal Architect: Blue Chip Consulting Group
Blog: http://dontpapanic.com/blog
Twitter: Follow @pstork
Please remember to mark your question as "answered" if this solves your problem.