Right ... when you make group changes you would need to log out and back in to see them.
Same for vnc ... the vnc server is logged in as a user, that service would need to re-login (restarting the service vncserver should do that) to see changes added for that user.
Thank you, everybody, for the help in diagnosing this.
Michael