How do I force a GPO to get reapplied on a client?

[Jeremy Schafer]

Hello,

My understanding of GPO states that GPOs although dynamically created
via your Active Directory structure, they keep some cached info of the
GPO so that it only applies itself when there are changes or when it is
removed. Is it possible to force a GPO to apply on a client by changing
something on the client?

I have an GPO that needs to be reapplied to one of the computers in an
OU not all so that is why I am asking if there is a way on the client to
do this.

Thanks.

 

[Steven L Umbach]

See the link below on how to use secedit to do this. There is a different
command depending if it is user or computer configuration you want to
refresh. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;227302

 

[David Gunnarsson]

On Windows XP:
gpupdate

Windows 2000
secedit

/David

 

[Jeremy Schafer]

Thanks to both of you for quick responses.

I have Windows 2000 and I was wondering if this also works for the
software installation portion of GPO.

I had an application that I removed from a client PC and want the GPO to
re-install it instead of manually installing it.

Thanks again.

 

[Chriss3]

Assigned Packages on User Basis are installed during logon. Assigned
Packages on Computer Basis are installed during startup, and can't be
re-installed with any command.

--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1

 

[Jeremy Schafer]

Assigned Packages on User Basis are installed during logon. Assigned
Packages on Computer Basis are installed during startup, and can't be
re-installed with any command.

It seems that you can have an application re-install on the client.
Granted, I don't understand completely why this worked but it worked
none the less. Here are the steps I used:

1) made sure I completely removed the package using MSIZap.

1a) reboot.

2) Used data from "gpresult /s" to get the UniqueName of the GPO used to
install the software. We have one software package per GPO so it makes
it easier to do this.

3) Went into the registry under
HKLM\Software\MS\Win\CurrentVersion\Group Policy\AppMgmt and edited the
GPOs REG_SZ word. I removed the UniqueName from the GPOs word. I also
removed the history key for my UniqueName.

4) used secedit /refreshpolicy machine_policy /enforce

5) rebooted and the package installed again without having to modify the
server configuration.


Who knows? I could have screwed myself up more than just fixing the
problem but at least on the surface everything seems to work a-ok.

 

[Chriss3]

oh yeah. what I mean was the packages can't be installed without perform a
reboot or logon.

--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1

 

[Derek Melber [MVP]]

Jeremy,

Maybe I am reading this different than everyone else, but I think you are
looking to force GPO application at each refresh interval? If so, you need
to set the policy behavior in the following GPO location:

Computer Configuration|Administrative Templates|System|Group Policy

In here, you will see a bunch of settings related to Security policy
processing, Registry policy processing, etc. Open those up and then you will
see a setting that states something like "Process even if the Group Policy
objects have not changed"

 

[Jeremy Schafer]

Jeremy,

Maybe I am reading this different than everyone else, but I think you are
looking to force GPO application at each refresh interval? If so, you need
to set the policy behavior in the following GPO location:

I was really looking to just have a GPO re-read from the server instead
of using the "cached" version. This would allow the application that I
had in there to be installed again. I seemed to have found the answer by
removing a few entries in HKLM.

Does anyone know where I can find documentation on the in-depth details
on how this all works? I could see myself asking more questions like
this one.

 

[Derek Melber [MVP]]

How which part works?

--
Derek Melber

I was really looking to just have a GPO re-read from the server instead
of using the "cached" version. This would allow the application that I
had in there to be installed again. I seemed to have found the answer by
removing a few entries in HKLM.

Does anyone know where I can find documentation on the in-depth details
on how this all works? I could see myself asking more questions like
this one.