Question : users do not stay in group

we have a group we set rights to dfs shares by called fac_security we replication amongst 4 dc's all are replicating, but when you and someone to this group the user shows as a member- it replicates across the dc's you can see it as a member of the group after several minutes maybe 5 the user is no longer in the group on any server-  this has been done with the domain administrator account so I know the user should have rights to do so .... this is effecting access to all server storage on our dfs shares please help

Answer : users do not stay in group

I suggest there is a restricted group somewhere in a GPO that is applied to the Domain Controller OU or the Domain Root.

See this link for more information:
http://www.windowsecurity.com/articles/Using-Restricted-Groups.html