19

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ComputerB) which grant read permission to a group GroupA. So I need to add the the computer account of ComputerA to the GroupA and restart the ComputerA.

My question is: is there a way to let the group membership immedialy take effect without restarting the ComputerA?

Improve this question

3 Answers 3

Reset to default
28 
For Windows 2008 and higher:

psexec -s -i -d cmd.exe

C:\Windows\system32>whoami
nt authority\system

-- List the session 0 tickets (0x3e7 is the machine session 0)
klist -lh 0 -li 0x3e7  

-- Purge the session 0 tickets  
klist -lh 0 -li 0x3e7 purge  

Should display:  

Current LogonId is 0:0x3e7  
        Deleting all tickets:  
        Ticket(s) purged!

PSExec is a free SysInternals download from Microsoft.

To clear up any confusion, this process absolutely will refresh the group memberships of a computer, and allow a group policy that applies to a security group to now apply to the computer, without rebooting the computer. This has been tested and verified on Windows Server 2012 R2 and Windows Server 2008 R2 and a universal security group. The short version would be:

  • psexec -s -i -d cmd.exe
  • klist tgt (view the current ticket, make note of the size. Also note that since you are running as system, the Current Logon Id is 0x3e7)
  • Add the computer to the security group. (Allow time to replicate, if applicable)
  • klist purge
  • nltest /dsgetdc:domain.com (run this or any other command that will connect to a network resource and force a TGT request)
  • klist tgt (view the current ticket, make note of the size. It should be slightly larger. Note that whoami /groups will not reflect the new membership)

At this point, it the system command prompt may be exited.

  • gpupdate /force
  • gpresult /h gpresult.html

View the gpreport, it should now show the group policy is applied.

Improve this answer
3
  • I can confirm this just worked on Server 2012 R2 and Server 2016
    – KellCOMnet
    Sep 4, 2017 at 16:39
  • Not working for me on Windows Server 2012 R2 (for both the member server, DCs, domain and forest functional level): I can purge the Kerberos tickets, but never got the new group (neither the klist tgt size changes, or whoami /groups reflects the new group). I've checked the change on the group is replicated through all the DCs.
    – curropar
    Oct 22, 2019 at 9:12
  • Well, as per shellandco.net/blog/2016/07/07/…, I've found none of those checks do reflect the new membership, but it's actually applied. This is true for my case: I can now execute the action depending on the new group, thanks!!
    – curropar
    Oct 22, 2019 at 9:30
2

I think restaring the netlogon service does the same thing, not sure what the overall impact would be. Pretty sure that users would be temporarily disconnect users though.

Improve this answer
2
  • For a Windows 7 workstation is this a solution without rebooting
    – 321X
    May 10, 2012 at 7:36
  • In my experience restarting the service had no effect on the group membership.
    – PHLiGHT
    Oct 16, 2013 at 20:18
-1

On my domain only works this for a network drive:

@echo off
net use M: /d /y
gpupdate /force
net use M: \\10.11.12.233\Archivos /persistent:Yes
explorer.exe M:
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .