Symantec Encryption Management Server is designed to manage users from Active Directory. When users are enrolled to the server these users are group automatically to the proper groups. If you change a user from one group to another, the user may not appear in that group until the periodic grouping event happens.
This periodic grouping happens every 6 hours or 4 times per day. If this is not frequent enough and you wish to have these users group sooner, please contact Symantec Encryption Support for assistance.
216112 - Prevent Symantec Encryption Management Server from harvesting X.509 certificates for Active Directory