Is there a way (short of rebooting) to force a machine to refresh its knowledge of its domain security group membership?