Solution for gpupdate /force won't apply the new filter group GPO, but computer restart will

 

Solution for gpupdate /force won't apply the new filter group GPO, but computer restart will

We’ve observed that machines recently added to a new group may not receive the updated Group Policy settings when running gpupdate /force. However, the policies apply successfully after a system restart.

This behavior is typically due to group membership token caching. When a machine is added to a new group, the updated group membership isn’t immediately reflected in the current session. A restart forces a refresh of the security token, allowing the correct policies to apply.

In this specific case, the affected machine was added to a group two days ago, and the GPO was applied to that group via Security Filtering. To ensure the updated group membership is recognized, the Kerberos ticket on the client machine needs to be purged.

This can be achieved by running the following command:

klist purge -li 3e7

Alternatively, a system reboot will also refresh the token and apply the correct policies.