How dynamic are Active Directory Policy Limitataions?

[jimd]

Have a Self Service Policy that is limited to specific users via an Active Directory group.

Client is complaining that they remove a user from the AD group, but the user can still see the policy in Self Service.

What's the mechanism here? When will the Policy "drop off" for that user? When their Mac checks in? When it Inventories? It's clearly NOT when they launch Self Service!

Would not having APNS be an issue here? (We don't have APNS... Not allowed by "Security".)

EDIT: User was removed from the AD group yesterday. Still sees the Policy in Self Service today.

[scottb]

Anything done in AD has to propagate through the system. It could be short or long, depending on the size of the company and complexity of the AD infrastructure.
What if you give it time - say to be safe - one hour, then logout and back in to the Mac.
Does it still show?

[rderewianko]

Further to that, if the client has an active session within Self service (not logged out) then it's going to continue to show until they re-login.

[jimd]

Sorry... False alarm. The Limitation had been removed from the Policy for testing. It's working better now!

[alexjdale]

In my experience, what matters is what your bound LDAP server thinks at the time the user logs into Self Service. You didn't say the user was logging into Self Service, which makes me wonder if the system is in scope regardless.