GPUPDATE Command Guide - Refresh Group Policy in Windows

The gpupdate command is a Windows Command Prompt utility that refreshes local and Active Directory-based Group Policy settings on a computer. Use gpupdate to apply policy changes immediately without waiting for the default refresh interval, or use /force to reapply all policies regardless of whether they changed—essential for IT administrators applying new GPOs, troubleshooting policy application, and ensuring consistent configuration across enterprise environments.

Whether you're deploying new software restrictions, updating security settings, or verifying that a newly linked Group Policy Object (GPO) has been applied, gpupdate gives you immediate control over when policies take effect. System administrators rely on this command after making GPO changes in Active Directory, when troubleshooting "policy not applied" issues, and for scripting configuration updates across workstations and servers.

This comprehensive guide covers gpupdate syntax, all parameters including /force and /target, practical examples for common scenarios, troubleshooting tips, related commands, and frequently asked questions. By the end, you'll confidently refresh Group Policy from the command line for efficient enterprise administration.

What Is the GPUPDATE Command?

The gpupdate command is a built-in Windows utility that triggers an immediate refresh of Group Policy settings. By default, Windows applies Group Policy in the background every 90 minutes (with a 30-minute random offset) for workstations and every 5 minutes for domain controllers. GPUPDATE bypasses this wait and applies policies on demand.

GPUPDATE is available in Windows XP Professional, Windows Server 2003, and all later Windows versions including Windows 10, Windows 11, and Windows Server 2022. It requires standard user permissions for user policy refresh; computer policy refresh typically requires administrator privileges. The command works in Command Prompt (CMD) and PowerShell.

GPUPDATE Command Syntax

gpupdate [/target:{computer|user}] [/force] [/wait:value] [/logoff] [/boot]

Parameters and Switches

Parameter	Description
`/target:computer`	Refresh computer policy only
`/target:user`	Refresh user policy only
`/force`	Reapply all policies, even if unchanged
`/wait:value`	Wait up to specified seconds for policy processing (default: 600)
`/logoff`	Log off after refresh if required by policy
`/boot`	Restart computer after refresh if required by policy
`/?`	Display help information

Parameters in Detail

/target:computer

Refreshes only computer (machine) policy. Use when you've changed computer-level GPOs such as security settings, software installation, or startup scripts. Computer policy applies to the machine regardless of which user is logged on.

Example: gpupdate /target:computer applies only computer-side policies. Useful when troubleshooting machine configuration without affecting user settings.

/target:user

Refreshes only user policy. Use when you've changed user-level GPOs such as drive mappings, folder redirection, or user environment variables. User policy applies to the currently logged-on user.

Example: gpupdate /target:user applies only user-side policies. Faster than full refresh when only user GPOs changed.

/force

Forces a complete reapplication of all policies, even those that haven't changed. By default, gpupdate skips unchanged policies. Use /force when policies aren't applying correctly, when you suspect cached policy issues, or when troubleshooting.

Example: gpupdate /force ensures every policy is re-evaluated and applied. Takes longer than a normal refresh but resolves many "policy not applying" issues.

Examples

Example 1: Basic Policy Refresh

Scenario: You've made changes to a GPO in Group Policy Management and want them applied immediately on your workstation.

gpupdate

Expected Output: Computer and user policies are refreshed. Output shows "Computer Policy update has completed successfully" and "User Policy update has completed successfully."

Example 2: Force Full Policy Reapplication

Scenario: A user reports that a new drive mapping isn't appearing. You suspect cached policy.

gpupdate /force

Expected Output: All policies are re-evaluated and applied. May take 1–2 minutes. Resolves most policy caching issues.

Example 3: Refresh Computer Policy Only

Scenario: You've updated a computer-level GPO (e.g., firewall rules) and want to apply it without refreshing user policy.

gpupdate /target:computer

Expected Output: Only computer policy is processed. Faster than full refresh when only machine settings changed.

Example 4: Refresh User Policy Only

Scenario: You've updated a user GPO (e.g., desktop shortcuts) and want to apply it for the current user.

gpupdate /target:user

Expected Output: Only user policy is processed. Useful when testing user-specific settings.

Example 5: Refresh with Logoff Requirement

Scenario: A policy requires logoff to take effect (e.g., some security settings).

gpupdate /logoff

Expected Output: Policies are applied. If any policy requires logoff, the user is logged off automatically. Use with caution on servers.

Example 6: Refresh with Reboot Requirement

Scenario: A policy requires reboot to take effect (e.g., driver installation, some security policies).

gpupdate /boot

Expected Output: Policies are applied. If any policy requires reboot, the computer restarts. Use only when necessary.

Example 7: Extended Wait for Slow Processing

Scenario: Policy processing is slow (many GPOs, slow network). Default 600-second timeout may not be enough.

gpupdate /wait:1200

Expected Output: GPUPDATE waits up to 20 minutes for policy processing to complete. Prevents premature timeout on slow systems.

Example 8: Combined Options

Scenario: Force refresh computer policy and log off if required.

gpupdate /target:computer /force /logoff

Expected Output: Computer policy is fully reapplied. User is logged off if any policy requires it.

Common Use Cases

Apply new GPO immediately – After linking a new GPO in Group Policy Management Console (GPMC), run gpupdate on target machines to apply without waiting for background refresh.
Troubleshoot "policy not applied" – When users report settings not taking effect, run gpupdate /force to clear cached policy and reapply.
Deploy software restrictions – After creating a software restriction GPO, run gpupdate on workstations to enforce the policy immediately.
Update drive mappings – User GPOs that map network drives require user policy refresh. Run gpupdate /target:user or have users run gpupdate.
Security policy rollout – After updating password policy, account lockout, or audit settings, run gpupdate to apply across domain-joined machines.
Scripted configuration – Include gpupdate in deployment scripts after applying registry or file changes to ensure GPO settings take precedence.
Verify GPO application – After gpupdate, use gpresult to confirm which policies were applied and in what order.
Remote administration – Use gpupdate in conjunction with remote execution tools (PsExec, SCCM) to refresh policy on multiple computers.
Post-imaging configuration – Run gpupdate after imaging workstations to ensure they receive current domain policies.
Troubleshooting folder redirection – User policy controls folder redirection; gpupdate /target:user applies redirection settings.
Compliance auditing – Ensure machines have latest security policies before audit by running gpupdate across the fleet.
Testing GPO changes – In lab environments, run gpupdate after each GPO edit to verify behavior before production rollout.

Tips and Best Practices

Run as Administrator for computer policy – Computer policy refresh typically requires elevated privileges. Run CMD as Administrator when refreshing both or computer-only policy.
Use /force sparingly – /force reprocesses all policies and can take several minutes. Use for troubleshooting; normal gpupdate is sufficient for typical updates.
Combine with gpresult – After gpupdate, run gpresult /r or gpresult /h report.html to verify which policies were applied.
Consider /logoff and /boot impact – /logoff and /boot can disrupt users. Use only when necessary and communicate with users.
Script with timeout – In automation scripts, use /wait with a value appropriate for your environment to avoid premature script failure.
Test in lab first – Before running gpupdate /force or /logoff across many machines, test in a lab to understand impact.
Document GPO change procedures – Include "run gpupdate on affected machines" in your GPO change runbook.
Use /target for faster refresh – When only computer or only user policy changed, use /target to reduce processing time.
Check event logs after gpupdate – Group Policy events in Event Viewer (Applications and Services Logs > Microsoft > Windows > GroupPolicy) show success or failure.
Avoid gpupdate on domain controllers during peak – DCs process policy for the entire domain; schedule gpupdate during off-hours if possible.

Troubleshooting Common Issues

"Access is denied" When Running GPUPDATE

Problem: GPUPDATE fails with access denied.

Cause: Computer policy refresh requires administrator privileges. Standard users can refresh user policy only.

Solution: Right-click Command Prompt and select "Run as administrator." For domain-joined machines, ensure the account has local admin rights.

Prevention: Document that computer policy refresh requires elevation. Use runas or deployment tools for non-admin scenarios.

Policy Still Not Applied After GPUPDATE

Problem: Settings don't change even after gpupdate /force.

Cause: GPO may not be linked to the correct OU; WMI filter may exclude the computer; policy may be disabled; loopback processing may override; conflicting GPOs.

Solution: Run gpresult /h report.html to see applied GPOs. Verify GPO link in GPMC. Check WMI filters. Ensure policy is enabled. Review loopback processing mode.

Prevention: Use GPMC to model policy (Group Policy Modeling) before deployment. Document GPO precedence.

GPUPDATE Hangs or Times Out

Problem: GPUPDATE doesn't complete; appears to hang.

Cause: Slow network to domain controller; many GPOs; slow WMI queries; DNS issues.

Solution: Increase /wait value: gpupdate /wait:1800. Check network connectivity to DC. Verify DNS resolution. Check Event Viewer for Group Policy errors.

Prevention: Ensure reliable network to DC. Reduce GPO count where possible. Use GPO optimization best practices.

User Policy Not Applying for Specific User

Problem: gpupdate /target:user runs but user doesn't see new settings.

Cause: User may need to log off and log on for some settings (e.g., folder redirection, some registry-based preferences).

Solution: Have user log off and log on. Some policies require full logon to apply. Use gpresult to verify user policy application.

Prevention: Document which policies require logoff. Communicate to users when logoff is needed.

"The processing of Group Policy failed" Error

Problem: GPUPDATE reports Group Policy processing failed.

Cause: Corrupted policy cache; SYSVOL/Netlogon access issues; DNS misconfiguration; DC unreachable.

Solution: Delete local policy cache: rd /s /q %windir%\System32\GroupPolicy\Machine and rd /s /q %windir%\System32\GroupPolicy\User (back up first). Run gpupdate /force. Verify DC connectivity with nltest /dsgetdc:.

Prevention: Maintain healthy AD replication. Monitor SYSVOL and Netlogon share availability.

Related Commands

gpresult – Group Policy Results

gpresult displays the Resultant Set of Policy (RSOP) for a user or computer. Use after gpupdate to verify which policies were applied and in what order. Essential for troubleshooting.

When to use gpresult: After gpupdate to confirm policy application. When diagnosing "policy not applied" issues. Example: gpresult /h report.html.

rsop – Resultant Set of Policy (GUI)

rsop.msc is the graphical RSOP tool. Shows same information as gpresult in MMC format. Use for interactive troubleshooting.

When to use: Prefer gpresult for scripting and reporting. Use rsop.msc for interactive review.

groupolicy – Group Policy Editor

gpedit.msc edits local Group Policy. For domain GPOs, use GPMC (gpmc.msc). GPUPDATE applies changes made in these tools.

When to use: Edit policy with gpedit/gpmc; apply with gpupdate.

nltest – Network and Domain Diagnostics

nltest verifies domain connectivity and locates domain controllers. Use when gpupdate fails due to DC unreachability.

When to use: nltest /dsgetdc:domainname to verify DC connectivity before gpupdate.

Frequently Asked Questions

What does the gpupdate command do?

GPUPDATE refreshes Group Policy settings on a Windows computer. It applies both computer and user policies from Active Directory and local Group Policy, making new or changed policies take effect immediately instead of waiting for the default 90-minute background refresh.

How do I force Group Policy to update?

Use gpupdate /force to reapply all policies regardless of whether they changed. This resolves many "policy not applied" issues caused by cached policy. Run Command Prompt as Administrator for full effect.

What is the difference between gpupdate and gpresult?

GPUPDATE applies Group Policy; gpresult displays which policies were applied (Resultant Set of Policy). Use gpupdate to refresh policy, then gpresult to verify application. They work together for troubleshooting.

How do I update only computer policy?

Use gpupdate /target:computer to refresh computer (machine) policy only. Use gpupdate /target:user to refresh user policy only. Omitting /target refreshes both.

Does gpupdate require a restart?

Not always. GPUPDATE applies policies immediately. Some policies (e.g., certain security settings, driver installation) require reboot. Use gpupdate /boot to restart automatically if a policy requires it.

Can I run gpupdate on a remote computer?

GPUPDATE has no built-in remote option. Use remote execution tools: PsExec (psexec \\computer gpupdate /force), PowerShell Invoke-Command, or SCCM to run gpupdate on remote machines.

How long does gpupdate take?

Typically 30 seconds to 2 minutes depending on GPO count, network speed, and DC response. Use /wait:value to extend timeout for slow environments. Default wait is 600 seconds.

Why does gpupdate say "No extension or custom action could be found"?

This warning is common and usually harmless. It indicates a client-side extension (CSE) for a specific policy type isn't installed or configured. It doesn't prevent other policies from applying. Ignore unless you're specifically troubleshooting that policy type.

Can standard users run gpupdate?

Yes, for user policy. Standard users can run gpupdate /target:user to refresh their user policy. Computer policy refresh typically requires administrator privileges.

How do I verify Group Policy was applied after gpupdate?

Run gpresult /r for a summary or gpresult /h report.html for a detailed HTML report. The report shows which GPOs were applied, their precedence, and any errors.

Quick Reference Card

Command	Purpose	Example Use Case
`gpupdate`	Refresh computer and user policy	Apply new GPO changes
`gpupdate /force`	Reapply all policies	Troubleshoot policy not applying
`gpupdate /target:computer`	Refresh computer policy only	Apply machine GPOs
`gpupdate /target:user`	Refresh user policy only	Apply user GPOs
`gpupdate /logoff`	Log off if policy requires	Apply logoff-required policies
`gpupdate /boot`	Reboot if policy requires	Apply reboot-required policies
`gpupdate /wait:1200`	Wait up to 20 minutes	Slow policy processing

Try the GPUPDATE Command in Our Simulator

Practice the gpupdate command safely in our Windows Command Simulator. Explore gpresult for verifying policy application, the Commands Reference for all Windows CMD utilities, and net share for network resource management.

Summary

The gpupdate command is essential for applying Group Policy changes immediately in Windows. Use gpupdate for standard refresh, gpupdate /force to reapply all policies when troubleshooting, and /target:computer or /target:user to refresh specific policy types. Combine with gpresult to verify policy application. Run as Administrator for computer policy. Follow best practices: use /force sparingly, document GPO change procedures, and test in lab before production rollout. Master gpupdate for efficient enterprise Group Policy management and troubleshooting.