Updating Group Policies with GPUpdate and GPUpdate /Force
I teach several classes that cover Windows deployment, operations, and troubleshooting. Most of the content I teach is focused on enterprise environments – that is, generally, more than 5,000 systems. At that scale centralized IT management is a requirement, not an option. And the cornerstone of centralized computer configuration management in Windows are Active Directory and Group Policy.
Many of my students relate stories of making changes to Group Policy settings. Usually the story goes something like, “We needed to change the screensaver timeout period to kick in after 5 minutes for the HR department. So I edited the Group Policy and under User Configuration, Administrative Templates, Control Panel, Personalization, I set the ‘Screen saver timeout’ to 600 seconds. Then I ran GPUpdate /force on the HR computers to get the setting.” A common alternate ending to that story is replacing the GPUpdate /force command with rebooting the computer.
Neither rebooting the computer nor running GPUpdate /force are necessary.
Group Policy Updates Itself
Yup, the Group Policy service on all domain-joined client computers regularly checks with Active Directory to see if anything has changed. If new or changed policies exist, they are applied to the computer. By default, Group Policy updates every 60 to 120 minutes, as well as during system startup. This is a configurable setting, but in my experience most IT shops don’t need it to be any shorter or longer. Background refresh can also be disabled, but this is also rarely done in an organization that actively uses Group Policy for configuration management.
That means the changed screen saver timeout setting, like all other Group Policy changes, will apply to all target computers within 2 hours without any further action. If the setting isn’t mission-critical (and most aren’t) you should not do anything further with the client computers.
Forcing Group Policy to Update Immediately
When considering how to make the Group Policy changes to apply immediately you should consider these points:
- Please don’t do this. You’re causing unnecessary overhead to client computers and domain controllers. Group Policy is designed to do it for you automagically.
- If you must, just use GPUpdate. GPUpdate scans for new and changed settings and applies only those changes.
- Don’t use GPUpdate /force. Adding the /force switch causes the Group Policy service to reprocess all policies, not just the changes. This is more taxing to the domain controllers and the client computers, and is only required when you believe there’s a problem with Group Policy applying correctly. No problem = no /force.
- You don’t need to reboot the computer to have Group Policy apply unless you’ve made a change that can only be applied on startup.
To be clear, using GPUpdate /force is quite helpful as a troubleshooting tool when there’s a problem downloading or applying policy. But it’s the wrong tool for its most common use: immediately applying a setting change.
Creating Users and Managing Passwords in Microsoft Office 365
In this Office 365 training video, instructor Spike Xavier demonstrates how to create users and manage passwords in Office 365. For instructor-led Office 365 training classes, see our course schedulle: Spike Xavier SharePoint Instructor – Interface Technical Training Phoenix, AZ 20347: Enabling and Managing Office 365
How to clone a Windows Server 2012 or 2012 R2 Domain Controller
One of the coolest new features in Window Server 2012 and Windows Server 2012 R2 is the ability to clone a Domain Controller. In the past, if we had virtualized Domain Controllers and we actually took a snapshot of it and then rolled back to that snapshot, it would break the logon service on that … Continue reading How to clone a Windows Server 2012 or 2012 R2 Domain Controller
Detailed Forensic Investigation of Malware Infections – April 21, 2015
How does an investigator hunt down and identify unknown malware? In this recording of our IT Security training webinar on April 21, 2015, Security expert Mike Danseglio (CISSP / CEH) performed several malware investigations on infected computers and identify symptoms, find root cause, and follow the leads to determine what’s happening. He demonstrated his preferred … Continue reading Detailed Forensic Investigation of Malware Infections – April 21, 2015
Write a Comment
See what people are saying...
Share your thoughts...
Excellent article explaining to avoid gpupdate /force.
However, I always thought that a computer policy requires a reboot for an “immediate” change. User policies a simple log off will suffice.
The background refresh is all well and good (the 90 min + 30 min random interval) but not sufficient enough for urgent changes. Hence, reboot server if an urgent change is required else gpupate will suffice but for multiple machines a reboot I would say is easier. Server 2012 and above allows us to force the policy through using gpmc.msc which is a life savior in my opinion otherwise Invoke-GPUpdate using Powershell I suppose.
Do you agree
Please correct me If I am wrong.