OU Membership user updates

[VoIPP]

I was hoping to apply a different set of group policies to a user by moving that user to a new OU. I would like the new polcies to apply without the user having to logon again.

It appears to me that the OU membership only updates when the user logs on.

Can anyone confirm this for me?

 

[Lemon13]

use gpupdate /force

Gpupdate.exe resides in the “%windir%\system32” folder by default, so we don't need an absolute path to its location on the remote workstation. The tool can be called with a number of different switches:

Syntax: Gpupdate [/Target:{Computer | User}] [/Force] [/Wait:<value>] [/Logoff] [/Boot] [/Sync]

M. Knorr

MCSE, MCTS, MCSA, CCNA

 

[VoIPP]

In my testing...

It appears the gpudate /force causes the user to update the GPO but not the OU membership.

So gpupdate only reapplies the GPO of the OU that was in effect when the user logged on.

 

[Lemon13]

http://www.windowsecurity.com/articles/How-Force-Remote-Group-Policy-Processing.html

have a look at flex command

M. Knorr

MCSE, MCTS, MCSA, CCNA

 

[VoIPP]

My problem is not that the group policies do not get updated they do. The problem is that the new OU membership is not recognized. Please read on...

There is only one DC.

My test procedure is....

Place account in OU-A with Policy-A
Logon account to workstation
Verify Policy Restictions are in place
Change one policy in OU-A
Move User account to OU-B
Run gpupdate /force on workstation

Results:
Policy that was changed in OU-A is now in effect, verifying the GPUpdate occured.
None of the policies in OU-B are applied indicating that the new OU membership is not recognized by GPUpdates.

My guess is that the OU membership becomes part of the logon token when a user is logged in like group memberships.
GPUpdate simply makes registry changes to HKEY_Current_User based on the OU information stored in the token.
Generally Tokens can be changed only by logging off and back on again.

 

[Lemon13]

i got your point, and i think flex command is able to handle that, because here you can choose the ou wich should be updated

http://www.250kb.de/u/090901/j/b1dba4b1.jpg

i have no time to try it right now, if you dont want to, you have to wait for other solutions

good luck

M. Knorr

MCSE, MCTS, MCSA, CCNA

 

[VoIPP]

I have to disagree Lemon13.

Flex allows me to choose the OU that has the computer accounts that psexec will execute gpupdate on.

My issue is with moving User accounts to new OU's post logon specifically to apply a different set of User polcies. Computer accounts have no bearing on the issue.

I've done manually exactly what Flex is going to do automatically and that is run gpupdate on the computer.

When gpupdate is run the policies of the OU that user belonged to at the time if logon take effect and the policies of the OU that the user has been moved to are completely ignored until the next logon. Running gpudate automatically instead of manually will not change that.