I'd like to see if there is a way to update a users machines group membership without having to restart the computer, and without having their login information. Ideally looking for something I can execute remotely with a script. I've found different ways to refresh the group membership, but most need the login information of the user, or direct access to the machine. We're trying to find a way that allows as little disruption to the user as possible. Thanks!


Restart is not necessary, but a logoff-logon cycle is needed to refresh NTLM authentication. While it's possible e.g. to force logoff after 5 minutes using shutdown /l /f /t 300, the /l for logoff is not available remotely with /m \\target.

Additionally, Kerberos authentication tickets can be reset with klist.exe since Windows 7. As you were looking for a solution that resets all Kerberos tickets, you need to use the special identifier:

klist -lh 0 -li 0x3e7 purge

There is a script for Purging the Kerberos ticket cache via klist on a remote machine. You could either use it as is or adopt the methods described:

The script uses Win32_ScheduledJob to schedule Klist. Klist queries the current tickets (klist -lh 0 -li 0x3e7 tickets) and purges them (klist -lh 0 -li 0x3e7 purge). Win32_Process is then used to create the process echo N | gpupdate /force /target:computer.

  • I meant logoff-logon cycle, my bad. Also this seems to work but we do use backgrounds as part of our group memberships, and those still don't get reset unless you logoff-logon. Is there a way to get around that? – ctooley17 May 16 '18 at 21:22
  • Not that I know of. Kerberos authentication tickets can be purged, and Kerberos is the replacement for NTLM and default since Windows 2000. See Comparing Windows Kerberos and NTLM Authentication Protocols. – Esa Jokinen May 17 '18 at 3:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.