How often does a computer update group policy

Membership in Administrators , or equivalent, is the minimum required to complete this procedure. Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. Contents Exit focus mode. Windows periodically refreshes group policy settings throughout the network.

On client computers, this is done by default every 90 minutes, with a randomized offset of plus or minus 30 minutes. When you make a change to a group policy, you may need to wait two hours 90 minutes plus a 30 minute offset before you see any changes on the client computers.

Even then, some changes will not take effect until after a reboot of the computer. You can change the default values by modifying the settings in Administrative Templates. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. For example, if we type 30 minutes, the system selects a variance of 0 to 30 minutes. When we enable the policy the update interval rate is set to 90 minutes and refresh interval time to 30 minutes by default.

We could change the settings as per our requirement. We will be applying this policy to a single computer, in our case it could be an OU or group of computers. Just add them to the security filtering section and close the GP management tool.

When we open the resultant set of policy settings, we see that the GP refresh interval settings are applied correctly. This is due to the Kerberos workflow explained below. There is another way to apply GPO linked to a computer account through security groups : playing with Kerberos When a computer starts, it will contact a domain controller and will begin Kerberos communication to get a token.

It creates the PAC structure : this structure includes information such as direct and transitive group membership, and encodes it into the TGT. To update the group membership of the computer, the solution is simple : first, purge the cached Kerberos tickets for the computer account and then instruct the Group Policy Client to refresh the policies.

The Group Policy Client will then contact a domain controller. As the Kerberos cache is empty, the computer will have to deal with the domain controller to get a new Kerberos token.