Domain group hierarchical group membership and SQL Logins mapped to AD groups SQL Version: Microsoft SQL Server 2005 - 9.00.4035.00 (X64) 
    Nov 24 2008 16:17:31 
    Copyright (c) 1988-2005 Microsoft Corporation
    Standard Edition (64-bit) on Windows NT 6.1 (Build 7601: Service Pack 1)

This is the AD group structure:  


Group A

User 4
Group B

User 1
User 2
User 3  




I granted Group A login access to my SQL instance (connect and dataReader/writer to Northwind db). 

I'd expect to be able to login to sql with User 1-4 but in fact only User 4 is allowed to login. If i grant Group B access then all users can login as expected.

So I'd venture to answer my own question and say "NO - sql only respects the 1st-level members of an AD sec group" but I wanted confirmation from someone else.

Logs show state 11 login failure which indicates "Valid login but server access failure."
This answer may not be of any real value since now the question becomes WHY is there a lag... 

but the AD changes were done 3 days ago and in my particular case, it took 3 days before SQL Server started recognizing the new members/groups added.

As of last night, when i executed EXEC xp_logininfo 'DOMAIN\User1','all' it returned nothing.. today (4th day since change) it shows the permission path as 'DOMAIN\GroupA'.