Server 2016 - Folder access still allowed despite Deny Rule
The users must logoff and logon again from their workstations before the group membership is effective, because group membership is retrieved from the Kerberos token which is acquired while logging in.