.png)
Force a Remote Group Policy Refresh (GPUpdate)
Updated: July 18, 2012
Applies To: Windows Server 2012
Group Policy is a complicated infrastructure that allows you to apply policy settings to remotely configure a computer and user experience within a domain. When the Resultant Set of Policy settings does not conform to your expectations, a best practice is to first verify that the computer and user has received the latest set of policy settings intended for a specified computer and user. In the previous versions of Windows, this was accomplished by having the user run GPUpdate.exe on their computer.
Starting with Windows Server® 2012 and Windows® 8, you can now remotely refresh Group Policy settings for all computers in an OU from one central location through the Group Policy Management Console (GPMC). Or you can use the Invoke-GPUpdate cmdlet to refresh Group Policy for a set of computers, not limited to the OU structure, for example, if the computers are located in the default computers container.
The remote Group Policy refresh updates all Group Policy settings, including security settings that are set on a group of remote computers, by using the functionality that is added to the context menu for an OU in the Group Policy Management Console (GPMC). When you select an OU to remotely refresh the Group Policy settings on all the computers in that OU, the following operations happen:
-
An Active Directory query returns a list of all computers that belong to that OU.
-
For each computer that belongs to the selected OU, a WMI call retrieves the list of logged on users.
-
A remote scheduled task is created to run Gpupdate.exe /force for each logged on user and once for the computer Group Policy refresh. The scheduled task is scheduled to run with a random delay of up to 10 minutes in order to decrease the load on the network traffic. This random delay cannot be configured when using the GPMC, but you can configure the random delay for the scheduled task or set the scheduled task to be run immediately when you use the Invoke-GPUpdate cmdlet.
This document describes a method to force a remote Group Policy refresh to all computers in an organizational unit (OU) and all OUs contained within the selected OU using the GPMC. An equivalent Windows PowerShell method will be presented after the GPMC procedure.
In this document
-
Prerequisites
-
Step 1: Configure firewall rules on each client that will be managed with remote Group Policy refresh (gpupdate.exe)
-
Step 2: Schedule a remote Group Policy refresh (gpupdate.exe)
 Note |
|---|
| This topic includes sample Windows PowerShell cmdlets that you can use to automate some of the procedures described. For more information, see How to Run a Windows PowerShell Cmdlet. |
You can only schedule to force a remote Group Policy update using the GPMC from domain-joined computers running:
-
Windows Server 2012
-
Windows 8 with Remote Server Administration Tools for Windows 8
You schedule a remote Group Policy refresh for any computer running:
-
Windows Server 2012
-
Windows Server 2008 R2
-
Windows Server 2008
-
Windows 8
-
Windows 7
-
Windows Vista
In order to successfully schedule a Group Policy refresh for domain-joined computers using either the GPMC or the Invoke-GPUpdate cmdlet, you must set firewall rules to support the inbound network traffic on ports to support the remote Group Policy refresh.
To schedule a Group Policy refresh for domain-joined computers using either the GPMC or the Invoke-GPUpdate cmdlet through the firewall, you must have firewall rules that enable inbound network traffic on the ports listed in the following table.
| Server port | Type of network traffic |
|---|---|
|
TCP RPC dynamic ports, Schedule (Task Scheduler service) |
Remote Scheduled Tasks Management (RPC) |
|
TCP port 135, RPCSS (Remote Procedure Call service) |
Remote Scheduled Tasks Management (RPC-EPMAP) |
|
TCP all ports, Winmgmt (Windows Management Instrumentation service) |
Windows Management Instrumentation (WMI-in) |
In Windows Server 2012, Group Policy adds a new Starter GPO called, Group Policy Remote Update Firewall Ports. This Starter GPO includes policy settings to configure the firewall rules, specified in the previous table that enables inbound network traffic on the ports necessary to allow the remote Group Policy refresh to be run. It is a best practice to create a new GPO from this Starter GPO and link the GPO to your domain, at a higher precedence than the Default Domain GPO, in order to configure all computers in the domain to enable a remote Group Policy refresh.
Do this step using Windows PowerShell
-
In the GPMC console tree, locate the domain for which you want to configure all computers to enable a remote Group Policy refresh.
-
Right-click the selected domain and then click Create a GPO in this domain, and Link it here…
-
In the New GPO dialog box, type the name of the new Group Policy object in the Name box.
-
Select the Group Policy Remote Update Firewall Ports Starter GPO from the Source Starter GPO list that you want to use to create a new Group Policy object.
-
Click OK.
-
In the results pane, click the Linked Group Policy Objects tab.
-
Select the GPO that you just created. Click the up arrow until the GPO you just created is above the Default Domain Policy in link order. The new GPO will then have a smaller link order value than the Default Domain Policy.
Windows PowerShell equivalent commands
The following Windows PowerShell cmdlet or cmdlets perform the same function as the preceding procedure. Enter each cmdlet on a single line, even though they may appear word-wrapped across several lines here because of formatting constraints.
You can use the New-GPO cmdlet with the –StarterGpoName parameter to create a GPO a new GPO. You can then pipe the output from the New-GPO cmdlet to the New-GPLink cmdlet.
For example, to create a new GPO, called Configure firewall rules for remote gpupdate, using the Group Policy Remote Update Firewall Ports Starter GPO and link the Configure firewall rules for remote gpupdate GPO to the Contoso.com domain, type the following:
New-GPO –Name "Configure firewall rules for remote gpupdate" –StarterGpoName "Group Policy Remote Update Firewall Ports" | New-GPLink –target "dc=Contoso,dc=com" –LinkEnabled yes
For more information about the New-GPO cmdlet and the New-GPLink cmdlet, see:
You can schedule gpupdate.exe to run on multiple computers from either the GPMC or from a Windows PowerShell session using the new Invoke-GPUpdate cmdlet. This procedure demonstrates both methods of forcing a remote Group Policy refresh.
Do this step using Windows PowerShell
-
In the GPMC console tree, locate the OU for which you want to refresh Group Policy for all computers located in that OU.
Note Group Policy will also be refreshed for all computers located in the OUs contained in the selected OU and for all the computers located in the OUs contained in the selected OU. -
Right-click the selected OU and then click Group Policy Update…
-
Click Yes in the Force Group Policy update dialog display. This is the equivalent to running the Gpupdate.exe /force from the command-line.
-
The Remote Group Policy update results window displays only the status of scheduling a Group Policy refresh for each computer located in the selected OU and any OUs contained within the selected OU. This display does not show the success or failure of the actual Group Policy refresh for each computer.
-
Use Resultant Set of Policy to determine the success of the scheduled Group Policy refresh, Determine Resultant Set of Policy.
Note You should factor in the delay of up to 10 minutes to start a Group Policy refresh when verifying the Group Policy refresh results for each computer.
Windows PowerShell equivalent commands
The following Windows PowerShell cmdlet or cmdlets perform the same function as the preceding procedure. Enter each cmdlet on a single line, even though they may appear word-wrapped across several lines here because of formatting constraints.
The Invoke-GPUpdate cmdlet allows you to schedule a remote Group Policy update for a specified computer with all the options that the gpupdate.exe command-line utility provides. This allows for more freedom to determine which the set of computers to be refreshed than scheduling the refresh through GPMC. Additionally, you have the freedom to configure the interval of time to wait before a Group Policy refresh is performed using the –RandomDelayInMinutes parameter. If set to a zero (0) value, the scheduled task for the Group Policy refresh will be configured to start immediately. For more information about the Invoke-GPUpdate cmdlet, see Invoke-GPUpdate.
You can refresh the changed Group Policy settings for the computer you are logged on by running the Invoke-GPUpdate cmdlet without including any parameters. For example:
Invoke-GPUpdate
You cannot schedule a Group Policy refresh for the Computers container using the GPMC Group Policy Update… functionality. The Computers container is a default location for computer accounts. It is not implemented as an OU that can be managed by the GPMC. By combining the use of the Active Directory cmdlet, Get-ADComputer with the Invoke-GPUpdate cmdlet, you can schedule a remote refresh for all computers in the Computers container. For more information about available Active Directory cmdlets for Windows Server 2012 see AD DS Administration Cmdlets in Windows PowerShell.
First obtain the list of computers in the Computers container using the Get-ADComputer cmdlet. Then supply the name of each computer that is returned to the Invoke-GPUpdate cmdlet.
For example, to force a refresh of all Group Policy settings for all computers in the Computers container for the Contoso.com domain, type the following:
Get-ADComputer –filter * -Searchbase "cn=computers, dc=Contoso,dc=com" | foreach{ Invoke-GPUpdate –computer $_.name -force}
You can force a Group Policy refresh for all Group Policy settings for all computers in a single OU when you combine the Get-ADComputer with the Invoke-GPUpdate cmdlet. For example, to force a refresh of all Group Policy settings for all computers in the Accounting OU of the Contoso.com domain, type the following:
Get-ADComputer –filter * -Searchbase "ou=Accounting, dc=Contoso,dc=com" | foreach{ Invoke-GPUpdate –computer $_.name -force}
You can force an immediate Group Policy refresh for all Group Policy settings for all computers in a single OU when you combine the Get-ADComputer with the Invoke-GPUpdate cmdlet and set the –-RandomDelayInMinutes to 0. For example, to force a refresh of all Group Policy settings for all computers in the Accounting OU of the Contoso.com domain, type the following:
Get-ADComputer –filter * -Searchbase "ou=Accounting, dc=Contoso,dc=com" | foreach{ Invoke-GPUpdate –computer $_.name –force –-RandomDelayInMinutes 0}
