Avatar of Kenneth Platt
Kenneth Platt
Flag for Guam asked on

Command needed to Force Group Policy to Process on all domain computers

I need a command that will force Group Policy to process on all computers in a domain
Windows Server 2008

Avatar of undefined
Last Comment
Kenneth Platt

8/22/2022 - Mon
Jose Gabriel Ortega Castro

gpupdate /force

Open in new window

copy the line and save it into a "name.bat"

and you can save the file into a new GPO and add it on the login script or logoff script
Kenneth Platt

I need a command that will update all computers in a domain not just one computer
Jose Gabriel Ortega Castro

Using GPO will update all computers
That's the reason why you do it as a login or logoff script

#Run from a domain controller

Import-Module ActiveDirectory
Import-Module GroupPolicy

Get-AdComputer -filter {enabled -eq $true} | select DNSHostName,Enabled | %{
    if(Test-Connection -Count 1 -ComputerName $_.DNSHostName ){
        Invoke-GPUpdate -computer $_.DNSHostName 
        Write-Host -ForegroundColor Red "Computer $($_.DNSHostname) is offline"


Open in new window

This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
Kenneth Platt

If I run this as a log in script in a GPO, doesn't the user need local administrator credentials vs a computer start up script does NOT require any credentials for it to run ???

It depends upon GPO setting configured
Not all computer settings get updated with gpupdate /force because some settings only update during computer reboot / startup
Either run above script from domain controller manually or wait for computer reboot, upon reboot computer must refresh all computer based GPO
Mal Osborne

You COULD construct a GPO to edit the GPO refresh interval. Of course, it needs to fire in the usual time before the new refresh rate applies.

The default is 90 mins, with a random 30 min offset. The offset stops all machines for trying to process GPOs at the exact same time in the event of returning from a power failure.

Although Windows will let you drop the refresh period to as low as 7seconds, this tends to annoy users, and can generate a lot of traffic if you have many machines and a slow network link. The user desktop redraws where GPOs are applied, users usually don't notice.  When trying out new GPOs, I have set this to 5mins in the past. That is a reasonable compromise. Change a setting, wait 5 mins, all machines will have applied it.  Of course, you can change this back once you finish playing.

More here: https://social.technet.microsoft.com/wiki/contents/articles/31623.modify-group-policy-refresh-interval-for-computers.aspx
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
Arun A

you can do with group policy management console or power shell

Power Shell cmd
Get-ADComputer –filter * -Searchbase "ou=LAB, dc=lab,dc=local" | foreach{ Invoke-GPUpdate –computer $_.name -force}
Roland Lee

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

Thanks for reminding option
Kenneth Platt

Thank you all for your efforts. I agree it's  a solution. I have to test it in terms of network usage.
Your help has saved me hundreds of hours of internet surfing.