Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a GPO that is assigning permissions to a folder on the user's C drive (computer configuration\Policies\Windows settings\security settings\File System). The folder that this applies to doesn't exist until an software application is distributed to the computer. The computer restarts after the installation and the GPO should be applied to the folder so that adequate permissions for the folder are set. The GPO's permissions are not being applied on restart. If I subsequently run gpupdate /force and then reboot, the permissions are applied as they should be.

I guess I'm not understanding under what instances the GPO for file permissions will be applied on a reboot or something. Is there a setting somewhere I can set so that it will enforce this security GPO policy every time the computer is restarted?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

There is no trigger for the GPO to be reapplied, so it won't be. You could:

  • Add gpupdate -force to the login script. This will support GPOs which apply to things that do not yet exist in general, but will slow up the login process.
  • Add gpupdate -force to the end of the installation script (or create an installation script if one doesn't already exist.
  • Add gpupdate -force as a repeating scheduled task using a time of @reboot to every computer

I suggest that the second option is likely the easiest.

share|improve this answer
1  
In recent documentation, it is reapplied to computers every 90 minutes, but I recall previous versions of windows only changing it after reboots or during login when the policy itself changes or a different set of GPOs would apply (eg. the computer is in a new OU). –  Falcon Momot Apr 12 '12 at 23:59
1  
This is the documentation I am referencing: link Regardless of what should be happening, if you want group policy to update upon installation of software, calling gpupdate /force clarifies your intentions. –  Falcon Momot Apr 13 '12 at 0:02
1  
I had seen that documentation and that's what I don't understand, the first paragraph says: "Policy is applied when the computer starts and when the user logs on." By this I assumed that the GPO would be reapplied on restart... Anyhow, looks like I'll somehow tie in a gpupdate into the end of the installation. –  yougotiger Apr 13 '12 at 0:07
1  
gpupdate /force is not a good idea in a logon script. It's possible that the script would stop and prompt the user to logoff. –  Greg Askew Apr 13 '12 at 1:09
1  
I've found that sometimes GPOs can take more than one reboot to apply. It may be that the first reboot will tell the computer that a new GPO is needed to be applied but finishes processing before it does apply, and it is not until the second reboot that it actually happens. –  Tubs Apr 13 '12 at 9:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.