- Mastering Windows Group Policy
- Jordan Krause
- 580字
- 2021-06-10 18:48:00
GPUpdate.exe switches
- gpupdate: The gpupdate command can be used on its own. This will initiate a regular background refresh cycle, meaning that it will only process GPOs that have been changed or updated within Group Policy. In my experience, running the command on its own doesn't usually do much.
- gpupdate /Force: By far the command that I issue most frequently, the /Force switch causes Group Policy to re-process and re-apply all of the policy settings. If you ever have a policy that doesn't seem to be applying, make sure to run this command at least once before doing any in-depth troubleshooting. This often clears it up. /Force causes a refresh at both the background and foreground levels.
- gpupdate /Sync: The /Sync switch doesn't actually initiate an immediate refresh of Group Policy like the other switches do. Instead, it flags the next foreground refresh to happen "synchronously". During a normal, everyday Windows login process, Group Policy processing is happening asynchronously, which means the login process will proceed and bring the user to a desktop even while Group Policy is still finishing its business in the background. Unfortunately, there are some processes that don't work super well with this asynchronous mentality, namely some ways of mapping drives or doing folder redirection. If you want to force the Windows login process to happen synchronously with Group Policy, thereby making sure that your policies are processing in order and properly during the next Windows login, for example, you could issue the gpupdate /Sync command and the next user login would follow that process.
- gpupdate /Boot: This causes the machine to restart after applying GPO settings, if one of the GPOs asks for a restart. Some policies are only able to apply during the computer boot process, such as software installation. Using /Boot is the switch to force that behavior.
- gpupdate /Logoff: Similar to /Boot, the /Logoff switch causes the user to be logged out of the computer after Group Policy has finished updating. This sounds useful because some policy settings can only be applied during the user login process, but this switch is a little silly because simply logging off the computer and logging back in will also cause that policy refresh cycle to happen, so I have never actually seen anybody use this switch.
- gpupdate /Wait <30>: Feel free to replace 30 with your own number of seconds. This switch causes Command Prompt to wait a certain number of seconds for GPO processing to finish, before returning to the cursor. This switch is generally only useful for scripted operations.
- gpupdate /Target:<User or Computer>: The Target switch can be used to refresh only one side of the GPO, or the other. If you want to test a change that you know is on the User side of policy, you can specify gpupdate /Target:User and update only that part of the policy. The same is true for Computer. The advantage to using this switch is purely for efficiency of that refresh. If you only need to pull a setting from one side, it shortens the amount of time that the Group Policy refresh takes to finish.
In order to test the gpupdate command, simply log in to the workstation where you want to test Group Policy refresh, open up Command Prompt, and enter gpupdate /Force. Group Policy will process, and any errors within that process cycle will be displayed. If everything has gone swimmingly, you will see the following, which indicates a successful run: