We've a 10.7.1 non portal deployment that uses an AD domain used for users and groups. New creations of users appear in the user store in Manager and through getRolesForUser immediately as we've cofigured minutesToCacheUserRoles to 0. However group changes for users take between 25 to 40 minutes. Sometimes Manager shows the new groups whilst getRolesForUser shows the old roles. Is there anyway to force an update through code or get minutesToCacheUserRoles to work for role changes?