In case you made a change on your AD, such as modifying groups or changing attributes of a user, it sometimes take a little while to reflect that on the Linux server that authenticates against AD via PBIS.

The best solution in that case is to clear the pbis cache and force pbis to sync immediately via this command:

sudo /opt/pbis/bin/ad-cache --delete-all

Enjoy!