1.) Remote User connected via VPN
2.) Run gpresult on client and check user group membership
3.) Add User on your AD controller to a new group
4.) Run gpupdate /force on the remote machine
5.) Run gpresult again

As you can see Group Membership will no be updated. Membership refresh only
happens during logon to the machine (not possible here, VPN User is using a
software certificate for auth which is only available to the user after
logon).

QUESTIONS:
1.) Is there a solution available to trigger the client to update Group
Membership Caching?
2.) Is this a known issue and solved with Vista?

Thanks a lot,
Herbert