How do I force a Group Policy update?

Sandeep Sidhu · 2026-08-01 · 5 min read

You changed a Group Policy Object and the setting did not appear on the target machine. Waiting for the automatic refresh cycle is slow and often irrelevant when a user needs access now or a service needs to start correctly. You need the policy applied immediately, without rebooting or logging off the entire department.

The standard tool for this is gpupdate, but using it incorrectly can cause unnecessary load on your domain controllers or fail to apply the specific change you made. Understanding the difference between a standard refresh and a forced update, and knowing how to verify the result, closes the ticket faster than guessing.

The command on the machine itself

Run gpupdate /force from an elevated command prompt to push the policy change to the local system. This command reapplies every policy on the machine, regardless of whether the configuration changed since the last refresh.

A plain gpupdate applies only policies that have changed since the last refresh cycle. This is usually sufficient for routine updates and places less load on the domain controller. Use /force only when a policy seems stuck or when you need to ensure a specific setting is reapplied immediately.

Useful switches allow you to target specific parts of the system. /target:computer or /target:user refreshes only one side. /logoff logs the user off afterwards if a setting requires it, such as per-user software installation or folder redirection. /boot restarts the machine if a computer setting needs it, like computer-assigned software installs. /sync makes the next startup or logon apply policy synchronously, preventing the user from logging in until the policy is applied.

What a refresh cannot do

The command finishes successfully, but the setting is still missing. A refresh cannot apply changes that require a new logon token or a system restart. Some settings only apply at logon or startup, including software installation and folder redirection.

Changes based on group membership need a new logon token to take effect. No amount of gpupdate helps until the user logs off and back on. If the change was made seconds ago on a different domain controller, it also has to replicate before the client can see it. The client cannot apply a policy that does not yet exist in its local cache.

Distinguish between a refresh failure and a design limitation. If the policy requires a reboot, the refresh command will not trigger it automatically unless you use the /boot switch. If the policy requires a new user context, the user must log off and back on. Trying to force these changes with gpupdate alone will waste time.

How often does Group Policy refresh on its own?

Group Policy refreshes on a schedule. Domain members refresh every 90 minutes with a random 0-30 minute offset. Domain controllers refresh every 5 minutes. Security settings reapply about every 16 hours regardless of change.

The random offset prevents network congestion by staggering requests to the domain controller. The 90-minute interval balances responsiveness with network load. You can adjust these intervals via policy, but the defaults are sane; leave them.

The schedule is also why a change sometimes lands on its own an hour later, after you have stopped looking.

How do I check that the policy applied?

Run gpresult /r for the applied-GPO summary. Run it elevated to see the computer side. Use gpresult /h C:\report.html for the full report. This shows which policies applied and which were denied.

"Filtering: Denied (Security)" in the output means security filtering or WMI filtering excluded the machine or user. This is a targeting problem, not a refresh problem. The policy exists, but the object is not in the scope. Check the security filtering on the GPO to ensure the user or computer group is included.

If the policy is not listed in the applied section, check the denied section. If it is not listed at all, the policy may not be linked to the OU, or the link may be disabled. The report gives you the exact reason for the failure.

How do I force a Group Policy update on a remote computer?

The technician needs to update machines they are not sitting at. There are three main ways to do this. First, use PowerShell with the RSAT GroupPolicy module: Invoke-GPUpdate -Computer "PC01" -RandomDelayInMinutes 0. This schedules an immediate gpupdate task on the target. The logged-on user may see a console window flash.

Second, use GPMC. Right-click the OU > Group Policy Update. This fires the same scheduled task on every computer in the OU. It needs the inbound firewall rules for Remote Scheduled Tasks Management (RPC and RPC-EPMAP) and WMI on the targets. Microsoft ships a Starter GPO named "Group Policy Remote Update Firewall Ports" that opens exactly these.

Third, use any remote shell. Run Invoke-Command -ComputerName PC01 -ScriptBlock { gpupdate /force }, or use an RMM agent's terminal. This works for machines off the VPN where WinRM and RPC cannot reach. There is more on the remoting options in how to run PowerShell on a remote computer, and if the machine is not reachable at all, start with why an agent shows offline.

Moorfox's remote terminal runs as SYSTEM, so gpupdate /force and gpresult /r run on any online machine without RDP, a VPN, or the firewall rules the GPMC method needs, and the same command can be saved and run across a whole group of machines at once, with each machine's output collected in one place.

Why is the GPO still not applying?

The technician forced the update, verified the command ran, but the setting is still missing. Check gpresult for Denied (Security/WMI). Check the setting is not foreground-only. Wait for or force DC replication if the edit is minutes old. Check the link is enabled and enforced/blocked inheritance is not eating it.

Read Event Viewer > Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational on the client. This log names the exact failing step. It provides detailed error codes and descriptions that gpresult does not show. Look for errors related to parsing, filtering, or application.

Still stuck after all of that: check domain controller health and replication (repadmin /replsummary). A GPO edit that exists on only one DC applies only to the clients that happen to talk to that DC, and no client-side command fixes that.

Frequently asked questions

What is the difference between gpupdate and gpupdate /force?

Plain gpupdate applies only policies that have changed since the last refresh, which is lighter on the domain controller. gpupdate /force reapplies every policy regardless of change, which is useful when a policy seems stuck but adds more load.

How often does group policy update by itself?

Domain members refresh every 90 minutes plus a random 0-30 minute offset. Domain controllers refresh every 5 minutes. Security settings reapply about every 16 hours regardless of change.

Why is my GPO not applying even after gpupdate /force?

Check gpresult for Denied (Security/WMI) or verify the setting is not foreground-only. Wait for or force DC replication if the edit is minutes old. Check that the link is enabled and inheritance is not blocked.

Do I need to reboot after gpupdate?

Only if a setting requires it. Use the /boot switch to restart the machine if a computer setting needs it, or /logoff to log the user off if a per-user setting requires it.

How do I force a group policy update on all computers in an OU?

Right-click the OU in GPMC and select Group Policy Update. Alternatively, use Invoke-GPUpdate against a computer list. Both methods require inbound firewall rules for Remote Scheduled Tasks Management and WMI on the targets.