Exam Ref 70-417 Upgrading Your Skills to Windows Server 2012 R2 (2014)

Remote Group Policy update

Windows Server 2012 and Windows Server 2012 R2 introduce a handy feature that is sure to please network administrators: the ability to perform a Group Policy update on many remote computers at once. You can accomplish this task by using either the Group Policy Management Console or Windows PowerShell. Before now, of course, you had to use the GPUpdate command on a local computer to refresh policy for just that computer and the locally logged-on user. If you wanted to update many computers at once, you had to use a script or a third-party tool.

Updating Group Policy in an organizational unit with Group Policy Management Console

To remotely refresh Group Policy in the Group Policy Management Console, simply right-click an organizational unit (OU) container in the console tree and select Group Policy Update from the shortcut menu, as shown in Figure 9-1. This step schedules GPUpdate.exe to be run within 10 minutes on all clients running Windows Vista or later and on all servers running Windows Server 2008 or later in that OU.

FIGURE 9-1 Updating Group Policy on all computers in an OU

Note the limitations: You can force a Group Policy refresh on all computers within a single OU and all subcontainers only. You cannot single out specific computers or update Group Policy on computers that are not located in an OU. (This restriction applies only to the Group Policy Management Console, not to Windows PowerShell.) Also, you cannot use this feature to update computers running operating systems earlier than Windows Vista and Windows Server 2008, whether through Group Policy Management or through Windows PowerShell.

After you select the Group Policy Update option, a message box appears indicating the number of computers that will be affected and asking you to confirm the update, as shown in Figure 9-2.

FIGURE 9-2 A remote update in Group Policy Management forces the update for all computers in an OU

When you give your consent, a window (shown in Figure 9-3) appears, indicating the success or failure of the scheduling of the update. The update itself is not immediate. As shown in Figure 9-3, the message indicates that a Group Policy update will be forced on all computers in the OU and all subcontainers within 10 minutes. This slight delay is a good thing when there are many computers in the OU: The computers will not all update at the same time and strain the resources of domain controllers.

FIGURE 9-3 Updating Group Policy on all computers in an OU

Updating Group Policy with Invoke-GPUpdate

You can update Group Policy on computers in a much more flexible way if you use the Invoke-GPUpdate cmdlet in Windows PowerShell.

Used by itself without any parameters, the cmdlet is similar to GPUpdate.exe; it updates Group Policy on the local computer only. The difference with GPUpdate.exe is that, as with the Group Policy Management Console, the task is not performed immediately but is scheduled to be completed within 10 minutes by default.

Used with the -Computer parameter however, the Invoke-GPUpdate cmdlet lets you update a remote computer, as in the following example:

Invoke-GPUpdate -Computer WS12-B

Other options you can use with Invoke-GPUpdate include -Force and -RandomDelayInMinutes. The -Force parameter resembles the /Force option with GPUpdate.exe: It reapplies all policy settings regardless of whether they have changed. The -RandomDelayInMinutes parameter allows you to specify a random interval in minutes up to the number of minutes specified, before the Group Policy update will be run. The purpose of this option is typically to reduce the network load on domain controllers when many remote computers are updated with a scripted command, but it can also be used with a single computer to reduce or remove the default delay of 10 minutes. A value of 0 will, in fact, cause the Group Policy refresh to run immediately. The following example therefore causes all Group Policy settings to be updated immediately on a computer named WS12-B:

Invoke-GPUpdate -Computer WS12-B -RandomDelayInMinutes 0 -Force

As mentioned, you can also leverage Windows PowerShell to execute the Invoke-GPUpdate cmdlet on more than one computer. You can begin with the Get-ADComputer cmdlet to retrieve any group of computer objects and then pipeline the results to a “ForEach” construction that includes Invoke-GPUpdate.

For example, the following command displays all of the computers in the container named Computers, in the Fabrikam.local domain:

Get-ADComputer -Filter * -Searchbase "CN=Computers,DC=Fabrikam,DC=local"

If you pipe the results of this command to a ForEach statement, you can execute the Invoke-GPUpdate cmdlet on each computer returned by the command. The net result of the following command, for example, is to schedule GPUpdate.exe to run on every computer in the Computers container within 10 minutes.

Get-ADComputer -Filter * -Searchbase "CN=Computers,DC=Fabrikam,DC=local" | ForEach
{Invoke-GPUpdate -Computer $_.name}

You don’t need to target computers in any specific container or OU. The following example attempts to schedule GPUpdate.exe to run on every computer in the domain within 10 minutes:

Get-ADComputer -Filter * | ForEach {Invoke-GPUpdate -Computer $_.name}

This next example schedules GPUpdate.exe to run immediately on every computer in the domain with a description that includes the term “finance”.

Get-ADComputer -Filter 'Description -like "*finance*"' | ForEach {Invoke-GPUpdate
-Computer $_.name -RandomDelayInMinutes 0}

One final example: The following schedules GPUpdate.exe to run immediately on all computers in the domain with an operating system name that includes the string “Vista”:

Get-ADComputer -Filter 'OperatingSystem -like "*Vista*"' | ForEach {Invoke-GPUpdate
-Computer $_.name -RandomDelayInMinutes 0}