After adding a new user to a Windows Group which is already part of a TFS group then you may get one of the following errors logging in as that user:
1) If you are getting a Team Plain error:
TF50309: You do not have sufficient permissions to perform this operation.
2) Visual Studio Team Explorer error TFS31003 when adding a new server
This handy article on managing TFS permissions states a brutal step to resolve this:
"Updating this list is one of the operations that TFS does on a schedule, If you're feeling impatient, you can force this list to refresh by recycling the IIS process on the TFS machine. "
You can also recycle the TFSAppPool (less brutal)
Or lastly, add the user to the TFS group you require (Contributor) and then remove the user in a couple of days when the TFS App Pool finally refreshes. Thanks to Ruth Fisher from the SDC for that handy hint.