Is there a way to refresh computer group membership without rebooting?

Question

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ComputerB) which grant read permission to a group GroupA. So I need to add the the computer account of ComputerA to the GroupA and restart the ComputerA.

My question is: is there a way to let the group membership immedialy take effect without restarting the ComputerA?

Answer 1

Give this a try:

1. Run a command prompt as the system account:  Start > Run > psexec /s /i /d cmd.exe  

2. Use 'klist purge' to purge all tickets

3. Run 'nltest /dclist:<domain>' (causing a request for a Kerberos TGT)

4. Run 'klist tgt' to verify that a new TGT has been received

For Windows XP/Server 2003 clients, klist is included in the Windows Server 2003 Resource Kit free download. Nltest is included in the Windows Server 2003 Support Tools free download. PSExec is a free SysInternals download from Microsoft.

Reference:

http://waynes-world-it.blogspot.com/2008/03/refreshing-computer-account-ad-group.html

Answer 2

I think restaring the netlogon service does the same thing, not sure what the overall impact would be. Pretty sure that users would be temporarily disconnect users though.