I am also experiencing this issue but the other way around. When users are removed from an AD group they continue to have permissions. Anyone know what is going on? I haven't run into this problem with the database engine.