How to Update Windows Group Policy on Domain Computers

In this article, we will take a look at the features of updating Group Policy settings on Active Directory domain computers:

• Automatic Group Policy update interval
• The GPUpdate command
• Remote update via the Group Policy Management Console (GPMC.msc)
• PowerShell Invoke-GPUpdate command

Group Policy Update Interval

In order for the new settings that you have defined in a Local or Domain Group Policy (GPO) to apply to clients, the Group Policy Client service must reload the policies and make changes to the client settings. This process is called updating Group Policies. Group Policy settings are updated when the computer boots up and the user logs on, or automatically in the background every 90 minutes plus random offset between 0 and 30 minutes (i.e., the policies are guaranteed to apply to clients between 90 and 120 minutes after the GPO files are updated on the domain controller).

Domain controllers by default update the GPO settings much more frequently – once every 5 minutes.
You can change the refresh interval for GPO settings using the Set Group Policy refresh interval for computers option, which is located in the GPO Computer Configuration ⇒ Administrative Templates ⇒ System ⇒ Group Policy section. Enable the policy and set the time (in minutes) in the following settings:

• This setting allows you to customize how often Group Policy is applied to computers (0 to 44640 minutes) – if you specify 0 here, the policies will start to update every 7 seconds – you should not do this
• This is a random time added to the refresh interval to prevent all clients from requesting Group Policy at the same time (0 to 1440 minutes) – the maximum value of a random time interval that is added as an offset to the previous setting.

Keep in mind that frequent GPO updates result in increased traffic to domain controllers and increased network load.

GPUpdate.exe – Group Policy Settings Update Command

All administrators are familiar with the gpupdate.exe command, which allows you to update group policy settings on your computer. Many of them do not hesitate to use the gpupdate /force command to update the GPO. This command forces the computer to reread all the policies from the domain controller and reapply all settings. The client accesses the domain controller, and receives ALL policies that are targeting it. This puts an increased load on the network and the domain controller.

A simple gpudate without /force key command applies only the new/changed GPO settings.

If all is OK when we update the GPO, the following lines should appear:

Updating policy…
Computer Policy Update has completed successfully.
User Policy Updating has completed successfully.

If any policies or settings have not applied, use the gpresult command to troubleshoot.

You can separately update GPO user settings by running the following command:

gpupdate /target:user

or just computer policies:

gpupdate /target:computer /force

If some policies cannot be updated in the background, gpudate can force the logoff of the current user:

gpupdate /target:user /logoff

Or reboot the computer (if the GPO changes can only be applied when Windows boots):

gpupdate /Boot

Force Update of Group Policy from the Group Policy Management Console

GPMC.msc (Group Policy Management Console), starting with Windows Server 2012, provides the ability to remotely update Group Policy settings on domain computers.

In Windows 10, you will need to install the RSAT component to use this console. In order to install it run the following command with administrator privileges:

Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0

Now, after changing the settings or creating and linking a new GPO, all you have to do is right click on the desired Organizational Unit (OU) in the GPMC and select Group Policy Update from the context menu. In the new window, you will see the number of computers that will update the GPO. Confirm the forced policy update by clicking Yes.

Then, the GPO begin to update on each computer in the OU and you get a result with the status of the policy update on the computers (Succeeded/Failed).

This command remotely creates a scheduled task on the computers with the GPUpdate.exe /force command for each logged user. The task starts at a random time interval (up to 10 minutes) to reduce the network load.

The following conditions must be met for this GPMC functionality to work on the client:

• TCP port 135 needs to be opened in Windows Firewall
• Windows Management Instrumentation and Task Scheduler services must be enabled

If the computer is shut down or access to it is blocked by the firewall, the message “The remote procedure call was cancelled” will appear next to the computer name.

In a nutshell, this functionality would have the same effect if you had manually updated the policy settings on each computer with the GPUpdate /force command.

Group Policy Update with Invoke-GPUpdate Powershell Command

You can also trigger remote Group Policy updates on computers using the Invoke-GPUpdate PowerShell cmdlet (included in the RSAT). For example, you can use the command to remotely update user policies on a specific computer:

Invoke-GPUpdate -Computer "domain\computer035" -Target "User".

When running the Invoke-GPUpdate command without settings, it updates the GPO settings on the current computer (gpudate.exe analogue).

When combined with the Get-ADComputer cmdlet, you can update Group Policies on all computers in a specific OU:

Get-ADComputer -filter * -Searchbase "ou=Computers,dc=domain,dc=com" | foreach{ Invoke-GPUpdate -computer $_.name -force}

Or all computers that fall under certain criteria (for example, all Windows Server in the domain):

Get-ADComputer -Filter {enabled -eq "true" -and OperatingSystem -Like 'Windows Server' }| foreach{ Invoke-GPUpdate -computer $_.name -RandomDelayInMinutes 10 -force}

You can specify a random delay in updating a GPO using the RandomDelayInMinutes setting. In this case you can reduce the load on the network if you want to update policies on multiple computers at the same time. The RandomDelayInMinutes 0 setting is used to apply the policies immediately.

For inaccessible computers, the command will return the error:

Invoke-GPUpdate: Computer "spb-srv01" is not responding. The target computer is either turned off or Remote Scheduled Tasks Management Firewall rules are disabled.

When running the Invoke-GPUpdate command remotely or updating a GPO through the GPMC, a cmd window may briefly appear on the user’s monitor with the gpupdate command running.