We use ISA standard edition in integrated mode and our PDC is a windows NT 4.0 , It needs authenticaion for outgoing web requests and everything seems to work properly except one: Assume this senario: we have a NT group named Morning_grp and there is a user John who is member of Morning_grp. In ISA, members of this group have Internet access only in morning. Theres is another group named Afternoon_grp for those who have Internet access only in afternoon. When I remove John from Morning_grp and add it to the Afternoon_grp, it takes for changes almost half an hour to take place. It means if it is morning, John still has the permission to use web. I wanted to know if it is a problem here or it is not a problem at all and this half an hour is natural. (I should say that if the web proxy service is restarted the changes will be applied immediately.) Thanks, shadi