Well, perhaps the object cache hadn't been refreshed and your change of group membership triggered it. There are also environmental issues like replication, communication or placement relative to a Globa Catalog. Without looking at the logs, it will be very unclear to pinpoint the issue.
Centrify's adclient contains varous caches (credential, authorization, connector, DNS, etc.) and the are commands that allow you to trigger theme (adflush and adobjectrefresh).
I'm not sure how familiar you are with the product, but there a a large number of commands that can help you:
https://community.centrify.com/t5/TechBlog/TIPS-A-Centrify-Server-Suite-Cheat-Sheet/ba-p/22568
LMK if you have additional questions.
R.P