I have had a strange thing happend in our 5.1 environment.
A specific AD user group had admin access to the whole environment. After renaming this group in AD and some waiting time, the access was still possible, but this groups members could not see anything else then the vCenter in their client. I thought, the SSO server is contacting the AD for any user logon procedures. The waiting time whos that there is still some replication happening and the permissions are not using the AD ID of the user but its exact name. Are there any way to rename groups and not to loose the permissions?