The question I'd like to ask is why do you need to change a group membership in an active session? There ought to be other ways to deal with the root of the problem perhaps...
we limit the amount of data received from internet. Using a ISA 2006 server by removing a user (students) from the internet allow group he or she have no internet connection anymore.
This is working the same as acces to a share or folder I tested this.
Peter
