How to Force a Group Policy Update on Remote Computers using PowerShell

The Delay in Group Policy Propagation

In a Windows Active Directory environment, Group Policy Objects (GPOs) are used to enforce security settings, map network drives, and deploy software. However, when you create or modify a GPO on the Domain Controller, the changes do not apply to client computers instantly. By default, Windows workstations only check the server for new policies every 90 minutes (plus a randomized offset of up to 30 minutes to prevent network flooding).

If you have just pushed out a critical firewall change that needs to take effect immediately, waiting two hours is unacceptable. While you could walk to a user’s desk and manually type gpupdate /force in their command prompt, PowerShell allows you to trigger this update remotely across hundreds of machines simultaneously.

Using the Invoke-GPUpdate Cmdlet

The Invoke-GPUpdate cmdlet is part of the GroupPolicy module, which is available on Domain Controllers or workstations with the Remote Server Administration Tools (RSAT) installed.

To force an immediate Group Policy update on a single remote computer named HR-DESKTOP-05, open an elevated PowerShell prompt and run:

Invoke-GPUpdate -Computer "HR-DESKTOP-05" -Force -RandomDelayInMinutes 0

Understanding the Parameters:

• -Computer: Specifies the target hostname.
• -Force: Bypasses standard optimization checks and forces the client to download and re-apply all policies, even if they haven’t changed. (This is the equivalent of the /force switch in the legacy command).
• -RandomDelayInMinutes 0: This is critical. By default, the cmdlet tells the remote computer to wait a random amount of time (up to 10 minutes) before updating. Setting this to 0 forces the update to occur the absolute instant the command is received.

Updating an Entire Organizational Unit (OU)

If you need to update an entire department, you can combine the Active Directory cmdlets (to grab a list of computers) with the Group Policy cmdlet.

First, retrieve all computers located in the Human Resources OU:

$Computers = Get-ADComputer -Filter * -SearchBase "OU=HumanResources,DC=corp,DC=contoso,DC=com"

Next, use a ForEach-Object loop to pipe every single computer name into the update command:

$Computers | ForEach-Object {
    Write-Host "Updating $($_.Name)..."
    Invoke-GPUpdate -Computer $_.Name -Force -RandomDelayInMinutes 0
}

Handling Reboot Requirements

Certain Group Policy settings (like software installations or folder redirection) cannot be applied while a user is actively logged in; they require a system reboot. If your new GPO includes these settings, you can append the -Boot or -Logoff parameters to the Invoke-GPUpdate command.

However, use extreme caution: If you append -Boot, the target computer will instantly reboot the moment it finishes downloading the policy, potentially causing the user to lose unsaved work.