User was removed from the group, but access continues
Finance membership is no longer present in the directory. Why does the old access continue in Tunahan's open application?
This evidence consists of synthetic examples created for teaching.
Evidence
09:00 · WS01
Interactive user session opened; the Finance SID is in the token.10:00 · DC01
Finance membership was removed.10:03 · DC02
Current membership query does not show Finance membership.10:05 · FS01
The SMB session established at 09:10 is still open; the application is using the same connection.Question
Which hypothesis should be tested first?