How to refresh AD security group on Sql Server permissions
The user need to log off of their workstation and log back on.  That's why the changes appear to take effect the next day.  The reason for this is that when the user logs on the next day they get a new token from the domain controller and this token contains the list of domain groups that they are a member of.  This token with the list of domain groups is only updated when the user logs in to their computer, so if the user never logs out the token isn't ever updated.

There's also multi-site domain replication delays which need to be taken into account if your domain controllers are in different physical locations.