We have a SharePoint Foundations site running on Windows 2008R2. We have some strange things happening around permissions/access. Users who could access the site before can no longer. If I go into Web Applications Management from the Central Admin and add a user under User Policy they can then access the site, but the entire site, which is not what we want, but at least they can now access the site.
The strange part is that if I add a new user to Active Directory and then add them to a SP group such as "Team Site Members" they can access the site fine. But any existing user in that same group gets access denied, even if I delete and re-add them to the group.
We did have an issue regarding our Active Directory where it had to be restored, so I think this is somehow related but SP sees the users just fine, seems to add the to groups fine, resolves their names when adding users.
I can't seem to find any logs that point to what is happening when a user gets "Error: Access Denied"
So basically the only way a user can access a site that they used to be able to is if I add them under "User Policy" from Central Admin, Web Applications Management.