Group Policy Refresh Intervals.

[boomam]

Hi.
I want to change the default intervals for a group policy refresh on our workstations to something a little faster.
Ideally, so it'll run on every boot.
Wheres best to change the intervals? the default domain policy, or create a new one just for it?
Any advice/warnings about changing it also?

Thanks in advance all. .

[ChrisH]

Your machine policy should refresh every time you boot and should your user policy when you log on. Be aware that changing the default settings can cause a lot of uneccessary traffic on your network.
If sounds more like you policies arent applying as they should therefore I would search on here for tips on troubleshooting that.
My other tip would be to never change your default domain policy. Make a policy at the same level and that way if you cock it up its easy to rectify.

[boomam]

Im finding that often machines need multiple reboots to pickup apps i have set to deploy via GPO. And often the same for settings.

DC Diag reports show that the policys are propogating correctly however?

I generally make network wide GP changes in a seperate GPO, but for the bigger changes, i generally document down the change and change it in the default policy.

[sahmeepee]

With app deployments via GPO you might be able to troubleshoot it quite quickly as you can see which machines in a suite aren't installing the software as they boot up.

You could then log onto a faulty one as an administrator and run rsop.msc to see what policies it thinks it should have and any errors during their application.

[maniac]

There's a policy called 'always wait for network' under computer settings which ensures that group policies are updated and read at every machine startup. Turning this on sorted out a whole host of problems for me, although it does slow down machine startups a bit.

Mike.

[boomam]

How much of a delay/slowdown are we talking?

[Michael]

@boomam - Out of curiosity, why do you want to speed up this process? Are you continuously changing policies? What are the reasons?

[ChrisH]

I have it set to wait as well and it doesnt take that much longer maybe 20 seconds. When I add apps they are picked up on the next boot on 90% of my machines. The others on the next boot after that.
There are also other factors that may be contributing to problems such as your network connectivity speed etc etc.

[maniac]

How much of a delay/slowdown are we talking?

It depends how many group policies you have, and how complecated they are, I've never really timed it to be honest! On our machines it's an acceptable speed, but is noticeable from when the policy is off. It really does help thou, it ensures my machine policies are refreshed at every re-start and user policies at every logon, and software always deploys with just a single re-start.

I'd stick one workstation in a seperate OU, create a policy to turn this setting on for it and compare the speed.

Mike.

[boomam]

@boomam - Out of curiosity, why do you want to speed up this process? Are you continuously changing policies? What are the reasons?

Because often policys take ages to apply to workstations, and im fed up of waiting/rebooting systems 5+ times in a row. .

[altecsole]

Because often policys take ages to apply to workstations, and im fed up of waiting/rebooting systems 5+ times in a row. .

I use a vbscript that takes a text file of compter names as an argument, pings each machine and if it's on runs 'gpupdate /target:computer /force /boot' against each one. The script uses 'psexec.exe' which is a free tool that you can get from sysinternals for running a program on a remote computer.

I can run the script against a room full of computers and I don't seem to have any problems with group policies being picked up.

[Ric_]

I use the SpecOps Gpupdate tool to get around the reboot issue. Just selt the updated computers in AD Users and Computers and away you go

See http://4sysops.com/archives/specops-gpupdate/ to get the tool.

[boomam]

You could then log onto a faulty one as an administrator and run rsop.msc to see what policies it thinks it should have and any errors during their application.

Interesting app, i didnt know it existed. .

There's a policy called 'always wait for network' under computer settings which ensures that group policies are updated and read at every machine startup. Turning this on sorted out a whole host of problems for me, although it does slow down machine startups a bit.

Mike.

Did you notice any problems with this method in your time using it? Im thinking about enabling it. .