Command needed to Force Group Policy to Process on all domain computers

Kenneth Platt
Kenneth Platt used Ask the Experts™
on
I need a command that will force Group Policy to process on all computers in a domain
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
gpupdate /force

Open in new window


copy the line and save it into a "name.bat"

and you can save the file into a new GPO and add it on the login script or logoff script
https://www.websense.com/content/support/library/web/v78/logon_agent/la_configure_scripts.aspx

Author

Commented:
I need a command that will update all computers in a domain not just one computer
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
Using GPO will update all computers
That's the reason why you do it as a login or logoff script

https://docs.microsoft.com/en-us/powershell/module/grouppolicy/invoke-gpupdate?view=win10-ps
#Run from a domain controller

Import-Module ActiveDirectory
Import-Module GroupPolicy

Get-AdComputer -filter {enabled -eq $true} | select DNSHostName,Enabled | %{
    if(Test-Connection -Count 1 -ComputerName $_.DNSHostName ){
        Invoke-GPUpdate -computer $_.DNSHostName 
    }
    else{
        Write-Host -ForegroundColor Red "Computer $($_.DNSHostname) is offline"
    }

}

Open in new window

OWASP: Avoiding Hacker Tricks

Learn to build secure applications from the mindset of the hacker and avoid being exploited.

Author

Commented:
If I run this as a log in script in a GPO, doesn't the user need local administrator credentials vs a computer start up script does NOT require any credentials for it to run ???
MaheshArchitect
Distinguished Expert 2018

Commented:
It depends upon GPO setting configured
Not all computer settings get updated with gpupdate /force because some settings only update during computer reboot / startup
Either run above script from domain controller manually or wait for computer reboot, upon reboot computer must refresh all computer based GPO
You COULD construct a GPO to edit the GPO refresh interval. Of course, it needs to fire in the usual time before the new refresh rate applies.

The default is 90 mins, with a random 30 min offset. The offset stops all machines for trying to process GPOs at the exact same time in the event of returning from a power failure.

Although Windows will let you drop the refresh period to as low as 7seconds, this tends to annoy users, and can generate a lot of traffic if you have many machines and a slow network link. The user desktop redraws where GPOs are applied, users usually don't notice.  When trying out new GPOs, I have set this to 5mins in the past. That is a reasonable compromise. Change a setting, wait 5 mins, all machines will have applied it.  Of course, you can change this back once you finish playing.

More here: https://social.technet.microsoft.com/wiki/contents/articles/31623.modify-group-policy-refresh-interval-for-computers.aspx
Arun ASr System Engineer

Commented:
you can do with group policy management console or power shell

Power Shell cmd
Get-ADComputer –filter * -Searchbase "ou=LAB, dc=lab,dc=local" | foreach{ Invoke-GPUpdate –computer $_.name -force}
gpo.docx
Senior Systems Engineer
Commented:
Go to GPMC, right click on the OU that you wish to push your GPO. Select "Group Policy Update". This will force an update to all your users and computers in the selected OU.

Hope this helps,
MaheshArchitect
Distinguished Expert 2018

Commented:
@Lee:
Thanks for reminding option

Author

Commented:
Thank you all for your efforts. I agree it's  a solution. I have to test it in terms of network usage.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial