Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We run a Windows 2008 network (2008 DC level). There are many users who work only from home and connect to the network via VPN.

Recently group membership was changed for many of these users and the membership isn't making it to their machine. I need a way I can update their Kerberos ticket with their security groups. Normally this happens at login, though these users are not connected to the network at login and don't get the updates.

gpupdate /force doesn't update the local Kerberos ticket. Using gpresult /r is being used to review current security groups for the user.

How can I get these updates to these users?

share|improve this question
    
Have them connect to VPN before AD auth. Every VPN client I've used is able to be configured in this way. –  EEAA Feb 2 '13 at 20:57
    
Sounds like a good solution which I can ask the VPN team about. Are there any other solutions since I have no control over the VPN configuration? –  Brettski Feb 2 '13 at 21:04

1 Answer 1

Try using a klist purge as login script, group policy scheduled task, etc. If run in the user context this should provide the response you want without changing the vpn setup.

I use a small script of a similar nature to refresh computer group memberships for deploying software without rebooting.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.