Logs don't lie
This reminds me of a recent exchange i had with a colleague.
we have a fortig(sh)ate which manages our vpn, and reads the permissions from a couple of AD groups.
the guy in question asked to be able to reach another subnet, so i changed his domain permissions and told him that the gateway needs a vpn restart to re-read the domain groups and apply his permissions.
he said that he'd done that and it still wasn't working, to which i diligently repeated that he needs to log the bloody ***ttyclient off and on again.
then he tried to raise his voice, hinting that i didn't know what he was doing, to which i replied that the dashboard was showing his session had been active for 3 hours, so clearly he hadn't logged off since i applied the changes.
He didn't offer to buy me a beer but i didn't hear from him since.