RHEL 7 and AD user help

We have our RHEL 7 nodes integrated into our windows AD everything is working except when we remove a user in AD from a group. The user still shows the group on the RHEL node.
Steps I have done.
stop sssd
ran sss_cache -E
start sssd
logged in as user in question
ran "id" and group that was removed on AD still shows.
I had my AD administrator remove the user and only add to one group. Ran steps above to clear cache. Same group still shows.
We have synced the AD thinking there was one not synced.
Checked netstat to see when domain controller was attached to look at it specifically and see if seen there.
When we had the user it had group 1/2/3 , recreated only with group 1, group 2 went away but group 3 is still there.
I have even removed the host from AD and re-registered with realm join and still same thing.
I have stopped sssd and removed the db and started again.
Anyone ever seen this? Did I miss something? I would hate to have to do this each time a user changes groups etc...