OU and Group policy replication

[Wesley H]

I am starting to understand GP's a little bit, but what I don't understand
is when you move a user account from one OU to another OU, when does that
get propagated if the user does not log out? I tried it today and used
gpresult.exe to keep checking if the user was indeed in the new OU, and it
seemed that it took a good 2 hours before it too effect. I thought this was
defined in the Default Domain Policy under Administrative
templates/system/group policy\group policy refresh for users, but when I
change that it still takes a long time. Any ideas?

Thanks,
Wes H

 

[Matthew Johnson]

You can force a group policy to refresh immediately
by using SECEDIT - KB Q227302

Matthew Johnson
(e-mail address removed)

 

[Matjaz Ladava [MVP]]

It took 90min to replicate. 90 min is default GPO refresh interval. See
http://www.microsoft.com/technet/tr...ver2003/proddocs/entserver/gpe_setrefresh.asp
or
http://www.microsoft.com/windows200...windows2000/en/server/help/gpe_setrefresh.htm
on how to change that

--
Regards

Matjaz Ladava, MCSE, MCSA, MCT, MVP
Microsoft MVP - Active Directory
(e-mail address removed), (e-mail address removed)
http://ladava.com

 

[Wesley H]

I tried to do that, but it doesn't seem to work when you actually change
OUs. If I was in the same OU and changed a security setting and policy the
refresh works immediately, but not when you change OU. Any ideas?

-Wes

 

[Diana Smith [MSFT]]

Hello Wesley,

Please take a look at the following article:
240790 Group Policy to Remove Program May Not Be Applied to Some Users and
http://support.microsoft.com/?id=240790

PS. Although it talks about removing a program, the concept of moving a
user to a new OU is explained.