When do policies update?

Hello.  I'm kind of new with the active directory stuff and
I'm having 
a hard time testing out certain policies in my domain.  I'm
wondering 
how long or what actions must occur for a policy change to
take 
effect.  Right now for instance I am trying to figure out
how to tweak 
my password requirements and account lockout settings but it
seems as 
if they never change after I change them.  Do I have to
reboot the 
client?  The server?  I'm confused on when they update. 
Please help.  
Thanks.


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Windows 2003" group.
To post to this group, send email to Windows2003googlegroups.com
To unsubscribe from this group, send email to
Windows2003-unsubscribegooglegroups.com
For more options, visit this group at http://groups-beta.google.com/group/Windows2003?hl=en
-~----------~----~----~----~------~----~------~--~---

Echo Vernocchi here.

>From the workstation (or whichever machine you want to
observe the 
policy effects on), run "gpupdate" at the command
prompt. If it's a 
User Configuration policy change, then you would see the
change after 
gpupdate, logoff, logon. If it's a Computer Configuration
change, then 
you see it after gpupdate, and restart.

GPupdate just bypasses the 90 minute (default) refresh
interval, and 
updates policy on the workstation immediately.

On Jan 29, 5:48 pm, "Vernocchi Pablo"
<pvernoc...gmail.com> wrote:
> It takes 90 minutes. Some policies require a reboot,
specially computer
> policies.
>
> You can force them with gpupdate command (Windows XP)
or secedit (Windows
> 2K).
>
> Regards,
>
> ------------------
>
> Pablo D. Vernocchi | Microsoft Exchange MVP
>
> MCSA + M / MCSE + Sec
>
> https://mvp.support.microsoft.com/profil
e=8E94A6C0-F6D9-4686-96D5-042...
> 1F
>
> http://www.itpros.com.ar

>
> -----Original Message-----
> From: Windows2003googlegroups.com [mailto:Windows2003googlegroups.com] On
>
> Behalf Of ridergroov
> Sent: Lunes, 29 de Enero de 2007 09:38 p.m.
> To: Windows 2003
> Subject: [Windows2003] When do policies update?
>
> Hello.  I'm kind of new with the active directory stuff
and I'm having
>
> a hard time testing out certain policies in my domain. 
I'm wondering
>
> how long or what actions must occur for a policy change
to take
>
> effect.  Right now for instance I am trying to figure
out how to tweak
>
> my password requirements and account lockout settings
but it seems as
>
> if they never change after I change them.  Do I have to
reboot the
>
> client?  The server?  I'm confused on when they update.
 Please help.
>
> Thanks.


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Windows 2003" group.
To post to this group, send email to Windows2003googlegroups.com
To unsubscribe from this group, send email to
Windows2003-unsubscribegooglegroups.com
For more options, visit this group at http://groups-beta.google.com/group/Windows2003?hl=en
-~----------~----~----~----~------~----~------~--~---

Sometimes you will need to use the /force option of the
gpupdate 
because the computer does not want to interrupt your work...
then it 
will auto prompt you to restart, and or logoff/on

On Jan 30, 12:07 pm, "Justin Brown - SYNACS"
<jcbr...gmail.com> 
wrote:
> Echo Vernocchi here.
>
> >From the workstation (or whichever machine you want
to observe thepolicy effects on), run "gpupdate"
at the command prompt. If it's a
> User Configuration policy change, then you would see
the change after
> gpupdate, logoff, logon. If it's a Computer
Configuration change, then
> you see it after gpupdate, and restart.
>
> GPupdate just bypasses the 90 minute (default) refresh
interval, and
> updates policy on the workstation immediately.
>
> On Jan 29, 5:48 pm, "Vernocchi Pablo"
<pvernoc...gmail.com> wrote:
>
> > It takes 90 minutes. Some policies require a
reboot, specially computer
> > policies.
>
> > You can force them with gpupdate command (Windows
XP) or secedit (Windows
> > 2K).
>
> > Regards,
>
> > ------------------
>
> > Pablo D. Vernocchi | Microsoft Exchange MVP
>
> > MCSA + M / MCSE + Sec
>
> >https://mvp.support.microsoft.com/profil
e=8E94A6C0-F6D9-4686-96D5-042...
> > 1F
>
> >http://www.itpros.com.ar

>
> > -----Original Message-----
> > From: Windows2003googlegroups.com
[mailto:Windows2003googlegroups.com] On
>
> > Behalf Of ridergroov
> > Sent: Lunes, 29 de Enero de 2007 09:38 p.m.
> > To: Windows 2003
> > Subject: [Windows2003] When do policies update?
>
> > Hello.  I'm kind of new with the active directory
stuff and I'm having
>
> > a hard time testing out certain policies in my
domain.  I'm wondering
>
> > how long or what actions must occur for a policy
change to take
>
> > effect.  Right now for instance I am trying to
figure out how to tweak
>
> > my password requirements and account lockout
settings but it seems as
>
> > if they never change after I change them.  Do I
have to reboot the
>
> > client?  The server?  I'm confused on when they
update.  Please help.
>
> > Thanks.


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Windows 2003" group.
To post to this group, send email to Windows2003googlegroups.com
To unsubscribe from this group, send email to
Windows2003-unsubscribegooglegroups.com
For more options, visit this group at http://groups-beta.google.com/group/Windows2003?hl=en
-~----------~----~----~----~------~----~------~--~---

Interesting.  From what you guys are saying it sounds like I
have to 
force the workstation to PULL the policy from teh server to
refresh 
it.  I was thinking that the policy had to be updated and
forced at 
the server.  So, I need to do gpupdate at the client
workstation and 
do nothing at the server or do I have to do something there
as well?  
Thanks for all the info.

On Jan 30, 2:22 pm, "Christopher.DeRe...gmail.com" 
<Christopher.DeRe...gmail.com> wrote:
> Sometimes you will need to use the /force option of the
gpupdate
> because the computer does not want to interrupt your
work... then it
> will auto prompt you to restart, and or logoff/on
>
> On Jan 30, 12:07 pm, "Justin Brown - SYNACS"
<jcbr...gmail.com>
> wrote:
>
> > Echo Vernocchi here.
>
> > >From the workstation (or whichever machine you
want to observe thepolicy effects on), run
"gpupdate" at the command prompt. If it's a
> > User Configuration policy change, then you would
see the change after
> > gpupdate, logoff, logon. If it's a Computer
Configuration change, then
> > you see it after gpupdate, and restart.
>
> > GPupdate just bypasses the 90 minute (default)
refresh interval, and
> > updates policy on the workstation immediately.
>
> > On Jan 29, 5:48 pm, "Vernocchi Pablo"
<pvernoc...gmail.com> wrote:
>
> > > It takes 90 minutes. Some policies require a
reboot, specially computer
> > > policies.
>
> > > You can force them with gpupdate command
(Windows XP) or secedit (Windows
> > > 2K).
>
> > > Regards,
>
> > > ------------------
>
> > > Pablo D. Vernocchi | Microsoft Exchange MVP
>
> > > MCSA + M / MCSE + Sec
>
> > >https://mvp.support.microsoft.com/profil
e=8E94A6C0-F6D9-4686-96D5-042...
> > > 1F
>
> > >http://www.itpros.com.ar

>
> > > -----Original Message-----
> > > From: Windows2003googlegroups.com
[mailto:Windows2003googlegroups.com] On
>
> > > Behalf Of ridergroov
> > > Sent: Lunes, 29 de Enero de 2007 09:38 p.m.
> > > To: Windows 2003
> > > Subject: [Windows2003] When do policies
update?
>
> > > Hello.  I'm kind of new with the active
directory stuff and I'm having
>
> > > a hard time testing out certain policies in
my domain.  I'm wondering
>
> > > how long or what actions must occur for a
policy change to take
>
> > > effect.  Right now for instance I am trying
to figure out how to tweak
>
> > > my password requirements and account lockout
settings but it seems as
>
> > > if they never change after I change them.  Do
I have to reboot the
>
> > > client?  The server?  I'm confused on when
they update.  Please help.
>
> > > Thanks.


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Windows 2003" group.
To post to this group, send email to Windows2003googlegroups.com
To unsubscribe from this group, send email to
Windows2003-unsubscribegooglegroups.com
For more options, visit this group at http://groups-beta.google.com/group/Windows2003?hl=en
-~----------~----~----~----~------~----~------~--~---

You can do nothing at the server if what I'm about to say is
true:

You have no group policy changes affecting the server itself
that need 
to take immediate effect.

Take, for example, the Default Domain Controllers Policy. If
that 
policy is linked and enabled, and you make a change to it,
and want to 
confirm the effects of that change, then and only then would
you care 
to run a gpupdate on that machine.

That's my take on it at least, and frankly I have *never*
seen a 
discussion on that topic, so kudos for asking what I think
is a great 
question. =]

On Jan 30, 11:51 am, "ridergroov"
<ridergro...comcast.net> wrote:
> Interesting.  From what you guys are saying it sounds
like I have to
> force the workstation to PULL the policy from teh
server to refresh
> it.  I was thinking that the policy had to be updated
and forced at
> the server.  So, I need to do gpupdate at the client
workstation and
> do nothing at the server or do I have to do something
there as well?
> Thanks for all the info.
>
> On Jan 30, 2:22 pm, "Christopher.DeRe...gmail.com"
>
> <Christopher.DeRe...gmail.com> wrote:
> > Sometimes you will need to use the /force option
of the gpupdate
> > because the computer does not want to interrupt
your work... then it
> > will auto prompt you to restart, and or logoff/on
>
> > On Jan 30, 12:07 pm, "Justin Brown -
SYNACS" <jcbr...gmail.com>
> > wrote:
>
> > > Echo Vernocchi here.
>
> > > >From the workstation (or whichever
machine you want to observe thepolicy effects on), run
"gpupdate" at the command prompt. If it's a
> > > User Configuration policy change, then you
would see the change after
> > > gpupdate, logoff, logon. If it's a Computer
Configuration change, then
> > > you see it after gpupdate, and restart.
>
> > > GPupdate just bypasses the 90 minute
(default) refresh interval, and
> > > updates policy on the workstation
immediately.
>
> > > On Jan 29, 5:48 pm, "Vernocchi
Pablo" <pvernoc...gmail.com> wrote:
>
> > > > It takes 90 minutes. Some policies
require a reboot, specially computer
> > > > policies.
>
> > > > You can force them with gpupdate command
(Windows XP) or secedit (Windows
> > > > 2K).
>
> > > > Regards,
>
> > > > ------------------
>
> > > > Pablo D. Vernocchi | Microsoft Exchange
MVP
>
> > > > MCSA + M / MCSE + Sec
>
> > > >https://mvp.support.microsoft.com/profil
e=8E94A6C0-F6D9-4686-96D5-042...
> > > > 1F
>
> > > >http://www.itpros.com.ar

>
> > > > -----Original Message-----
> > > > From: Windows2003googlegroups.com
[mailto:Windows2003googlegroups.com] On
>
> > > > Behalf Of ridergroov
> > > > Sent: Lunes, 29 de Enero de 2007 09:38
p.m.
> > > > To: Windows 2003
> > > > Subject: [Windows2003] When do policies
update?
>
> > > > Hello.  I'm kind of new with the active
directory stuff and I'm having
>
> > > > a hard time testing out certain policies
in my domain.  I'm wondering
>
> > > > how long or what actions must occur for
a policy change to take
>
> > > > effect.  Right now for instance I am
trying to figure out how to tweak
>
> > > > my password requirements and account
lockout settings but it seems as
>
> > > > if they never change after I change
them.  Do I have to reboot the
>
> > > > client?  The server?  I'm confused on
when they update.  Please help.
>
> > > > Thanks.


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Windows 2003" group.
To post to this group, send email to Windows2003googlegroups.com
To unsubscribe from this group, send email to
Windows2003-unsubscribegooglegroups.com
For more options, visit this group at http://groups-beta.google.com/group/Windows2003?hl=en
-~----------~----~----~----~------~----~------~--~---

Justin you are certainly all over these forums.  Thank you
for your 
continued help.  I don't think I have any policies that
affect the 
server.  I am only working through the default domain policy
and 
changing things under windows settings for the most part. 
When you 
say "run gpupdate" on that machine, do you mean
the client machine i 
am testing with it or the server?  Much thanks again.

On Jan 30, 4:01 pm, "Justin Brown - SYNACS"
<jcbr...gmail.com> wrote:
> You can do nothing at the server if what I'm about to
say is true:
>
> You have no group policy changes affecting the server
itself that need
> to take immediate effect.
>
> Take, for example, the Default Domain Controllers
Policy. If that
> policy is linked and enabled, and you make a change to
it, and want to
> confirm the effects of that change, then and only then
would you care
> to run a gpupdate on that machine.
>
> That's my take on it at least, and frankly I have
*never* seen a
> discussion on that topic, so kudos for asking what I
think is a great
> question. =]
>
> On Jan 30, 11:51 am, "ridergroov"
<ridergro...comcast.net> wrote:
>
> > Interesting.  From what you guys are saying it
sounds like I have to
> > force the workstation to PULL the policy from teh
server to refresh
> > it.  I was thinking that the policy had to be
updated and forced at
> > the server.  So, I need to do gpupdate at the
client workstation and
> > do nothing at the server or do I have to do
something there as well?
> > Thanks for all the info.
>
> > On Jan 30, 2:22 pm, "Christopher.DeRe...gmail.com"
>
> > <Christopher.DeRe...gmail.com> wrote:
> > > Sometimes you will need to use the /force
option of the gpupdate
> > > because the computer does not want to
interrupt your work... then it
> > > will auto prompt you to restart, and or
logoff/on
>
> > > On Jan 30, 12:07 pm, "Justin Brown -
SYNACS" <jcbr...gmail.com>
> > > wrote:
>
> > > > Echo Vernocchi here.
>
> > > > >From the workstation (or whichever
machine you want to observe thepolicy effects on), run
"gpupdate" at the command prompt. If it's a
> > > > User Configuration policy change, then
you would see the change after
> > > > gpupdate, logoff, logon. If it's a
Computer Configuration change, then
> > > > you see it after gpupdate, and restart.
>
> > > > GPupdate just bypasses the 90 minute
(default) refresh interval, and
> > > > updates policy on the workstation
immediately.
>
> > > > On Jan 29, 5:48 pm, "Vernocchi
Pablo" <pvernoc...gmail.com> wrote:
>
> > > > > It takes 90 minutes. Some policies
require a reboot, specially computer
> > > > > policies.
>
> > > > > You can force them with gpupdate
command (Windows XP) or secedit (Windows
> > > > > 2K).
>
> > > > > Regards,
>
> > > > > ------------------
>
> > > > > Pablo D. Vernocchi | Microsoft
Exchange MVP
>
> > > > > MCSA + M / MCSE + Sec
>
> > > > >https://mvp.support.microsoft.com/profil
e=8E94A6C0-F6D9-4686-96D5-042...
> > > > > 1F
>
> > > > >http://www.itpros.com.ar

>
> > > > > -----Original Message-----
> > > > > From: Windows2003googlegroups.com [mailto:Windows2003googlegroups.com] On
>
> > > > > Behalf Of ridergroov
> > > > > Sent: Lunes, 29 de Enero de 2007
09:38 p.m.
> > > > > To: Windows 2003
> > > > > Subject: [Windows2003] When do
policies update?
>
> > > > > Hello.  I'm kind of new with the
active directory stuff and I'm having
>
> > > > > a hard time testing out certain
policies in my domain.  I'm wondering
>
> > > > > how long or what actions must occur
for a policy change to take
>
> > > > > effect.  Right now for instance I
am trying to figure out how to tweak
>
> > > > > my password requirements and
account lockout settings but it seems as
>
> > > > > if they never change after I change
them.  Do I have to reboot the
>
> > > > > client?  The server?  I'm confused
on when they update.  Please help.
>
> > > > > Thanks.


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Windows 2003" group.
To post to this group, send email to Windows2003googlegroups.com
To unsubscribe from this group, send email to
Windows2003-unsubscribegooglegroups.com
For more options, visit this group at http://groups-beta.google.com/group/Windows2003?hl=en
-~----------~----~----~----~------~----~------~--~---

By "that machine" I mean the server, which also
recieves group policy
updates periodically just as the workstations do (even
though the
changes themselves were made at that server).

One thing you might consider is creating an Organizational
Unit for
workstations (via ADUC), moving the computer objects into
that OU, and
linking a new GPO to that OU. That way you can make policy
changes
that affect only workstations or even just a single
workstation, like
for testing and stuff.

ridergroov wrote:
> Justin you are certainly all over these forums.  Thank
you for your
> continued help.  I don't think I have any policies that
affect the
> server.  I am only working through the default domain
policy and
> changing things under windows settings for the most
part.  When you
> say "run gpupdate" on that machine, do you
mean the client machine i
> am testing with it or the server?  Much thanks again.
>
> On Jan 30, 4:01 pm, "Justin Brown - SYNACS"
<jcbr...gmail.com> wrote:
> > You can do nothing at the server if what I'm about
to say is true:
> >
> > You have no group policy changes affecting the
server itself that need
> > to take immediate effect.
> >
> > Take, for example, the Default Domain Controllers
Policy. If that
> > policy is linked and enabled, and you make a
change to it, and want to
> > confirm the effects of that change, then and only
then would you care
> > to run a gpupdate on that machine.
> >
> > That's my take on it at least, and frankly I have
*never* seen a
> > discussion on that topic, so kudos for asking what
I think is a great
> > question. =]
> >
> > On Jan 30, 11:51 am, "ridergroov"
<ridergro...comcast.net> wrote:
> >
> > > Interesting.  From what you guys are saying
it sounds like I have to
> > > force the workstation to PULL the policy from
teh server to refresh
> > > it.  I was thinking that the policy had to be
updated and forced at
> > > the server.  So, I need to do gpupdate at the
client workstation and
> > > do nothing at the server or do I have to do
something there as well?
> > > Thanks for all the info.
> >
> > > On Jan 30, 2:22 pm,
"Christopher.DeRe...gmail.com"
> >
> > > <Christopher.DeRe...gmail.com> wrote:
> > > > Sometimes you will need to use the
/force option of the gpupdate
> > > > because the computer does not want to
interrupt your work... then it
> > > > will auto prompt you to restart, and or
logoff/on
> >
> > > > On Jan 30, 12:07 pm, "Justin Brown
- SYNACS" <jcbr...gmail.com>
> > > > wrote:
> >
> > > > > Echo Vernocchi here.
> >
> > > > > >From the workstation (or
whichever machine you want to observe thepolicy effects on),
run "gpupdate" at the command prompt. If it's a
> > > > > User Configuration policy change,
then you would see the change after
> > > > > gpupdate, logoff, logon. If it's a
Computer Configuration change, then
> > > > > you see it after gpupdate, and
restart.
> >
> > > > > GPupdate just bypasses the 90
minute (default) refresh interval, and
> > > > > updates policy on the workstation
immediately.
> >
> > > > > On Jan 29, 5:48 pm, "Vernocchi
Pablo" <pvernoc...gmail.com> wrote:
> >
> > > > > > It takes 90 minutes. Some
policies require a reboot, specially computer
> > > > > > policies.
> >
> > > > > > You can force them with
gpupdate command (Windows XP) or secedit (Windows
> > > > > > 2K).
> >
> > > > > > Regards,
> >
> > > > > > ------------------
> >
> > > > > > Pablo D. Vernocchi | Microsoft
Exchange MVP
> >
> > > > > > MCSA + M / MCSE + Sec
> >
> > > > > >https://mvp.support.microsoft.com/profil
e=8E94A6C0-F6D9-4686-96D5-042...
> > > > > > 1F
> >
> > > > > >http://www.itpros.com.ar

> >
> > > > > > -----Original Message-----
> > > > > > From: Windows2003googlegroups.com [mailto:Windows2003googlegroups.com] On
> >
> > > > > > Behalf Of ridergroov
> > > > > > Sent: Lunes, 29 de Enero de
2007 09:38 p.m.
> > > > > > To: Windows 2003
> > > > > > Subject: [Windows2003] When do
policies update?
> >
> > > > > > Hello.  I'm kind of new with
the active directory stuff and I'm having
> >
> > > > > > a hard time testing out
certain policies in my domain.  I'm wondering
> >
> > > > > > how long or what actions must
occur for a policy change to take
> >
> > > > > > effect.  Right now for
instance I am trying to figure out how to tweak
> >
> > > > > > my password requirements and
account lockout settings but it seems as
> >
> > > > > > if they never change after I
change them.  Do I have to reboot the
> >
> > > > > > client?  The server?  I'm
confused on when they update.  Please help.
> >
> > > > > > Thanks.


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Windows 2003" group.
To post to this group, send email to Windows2003googlegroups.com
To unsubscribe from this group, send email to
Windows2003-unsubscribegooglegroups.com
For more options, visit this group at http://groups-beta.google.com/group/Windows2003?hl=en
-~----------~----~----~----~------~----~------~--~---