gpupdate /force: Commands, Examples & Reports (2026)

Verified June 2026 · tested on Windows 11 24H2, Windows 10 22H2 & Server 2022/2025

---

Quick Reference: Essential Commands

Need to apply Group Policy right now? Here are the most common commands:

# Force a full local refresh (re-applies every setting)
gpupdate /force

# Refresh only computer or only user policy
gpupdate /target:computer /force
gpupdate /target:user /force

# Show which GPOs applied (console summary)
gpresult /r

# Full HTML report of applied policy
gpresult /h C:\Temp\GPReport.html /f

# Force a refresh on a remote computer (GroupPolicy / RSAT module)
Invoke-GPUpdate -Computer PC-01 -Force

Which command do you need?

• Apply a policy change now → gpupdate /force
• See what actually applied (and why) → gpresult
• Push to remote computers or a whole OU → Invoke-GPUpdate
• Back up or list GPOs → GroupPolicy module

Jump to the section you need below, or use the builder at the top to assemble the command for you.

---

gpupdate: Force a Policy Refresh

gpupdate.exe re-applies Group Policy on the local machine. By default Windows refreshes policy in the background every 90 minutes (plus a 0–30 minute random offset); gpupdate triggers that refresh on demand.

Windows 10Windows 11Server 2016+Built in — no module

gpupdate Switch Reference

Switch	Description
/force	Re-apply all policy settings, not just changed ones
/target:{computer|user}	Refresh only computer or only user policy
/sync	Force the next foreground (startup/logon) refresh — required for software install, folder redirection, drive maps
/wait:{seconds}	How long to wait for processing to finish (default 600; 0 = don't wait, -1 = wait indefinitely)
/logoff	Log off after refreshing (for policies that apply only at logon)
/boot	Reboot after refreshing (for policies that apply only at startup)

gpupdate Usage Examples

# Standard force refresh of both user and computer policy
gpupdate /force

# Re-apply computer policy and reboot if a setting requires it
gpupdate /target:computer /force /boot

# Re-apply user policy and log off if needed
gpupdate /target:user /force /logoff

# Schedule a foreground sync at next boot (for folder redirection, etc.)
gpupdate /force /sync

# Don't block the console waiting for processing
gpupdate /force /wait:0

Tip: Plain gpupdate only re-applies settings that changed since the last refresh. After editing a GPO or while troubleshooting, always use gpupdate /force so every setting is re-evaluated.

---

gpresult: Report on Applied Policy

gpresult.exe produces a Resultant Set of Policy (RSoP) report — the definitive answer to "which GPOs actually applied to this user/computer, and which ones were filtered out?"

Windows 10Windows 11Server 2016+Built in — no module

gpresult Switch Reference

Switch	Description
/r	Summary RSoP data in the console
/v / /z	Verbose / super-verbose detail
/h {file}	Write a full HTML report
/scope {computer|user}	Limit output to computer or user settings
/user {DOMAIN\\user}	Report on a specific user
/s {computer}	Query a remote computer
/f	Overwrite the report file without prompting

gpresult Usage Examples

# Console summary of applied policy
gpresult /r

# Full HTML report (the most useful for troubleshooting)
gpresult /h C:\Temp\GPReport.html /f

# Only computer-side policy, super-verbose
gpresult /scope computer /z

# Report on a specific user
gpresult /user CORP\jsmith /h C:\Temp\jsmith.html /f

# Query a remote computer
gpresult /s PC-01 /r

Note: Run gpresult /r from the affected user's own session for user-side data. For computer-side data (/scope computer), run from an elevated prompt — otherwise you'll see "Access denied" or "does not have RSOP data."

---

Invoke-GPUpdate: Refresh Remote Computers

gpupdate.exe only runs locally. To refresh policy on remote machines, use the GroupPolicy PowerShell module (part of RSAT, installed by default on domain controllers).

Requires GroupPolicy module (RSAT)Local & remote⚠ Targets need WinRM enabled

# Refresh a single remote computer
Invoke-GPUpdate -Computer "PC-01" -Force

# Refresh a remote computer's user policy only, with a 10-minute random delay
Invoke-GPUpdate -Computer "PC-01" -Target "User" -RandomDelayInMinutes 10 -Force

# Refresh every computer in an organizational unit
Get-ADComputer -Filter * -SearchBase "OU=Workstations,DC=corp,DC=local" |
    ForEach-Object { Invoke-GPUpdate -Computer $_.Name -Force }

# Fan out to an explicit list of computers
"PC-01","PC-02","PC-03" | ForEach-Object { Invoke-GPUpdate -Computer $_ -Force }

WinRM is required. Invoke-GPUpdate reaches targets over Windows Remote Management. If you get "WinRM cannot complete the operation," run Enable-PSRemoting -Force on the target (or push it via a GPO) and confirm the firewall allows WinRM.

---

Manage GPOs: Backup and Inventory

The GroupPolicy module also handles GPO lifecycle tasks from the command line.

# Back up every GPO in the domain
Backup-GPO -All -Path C:\GPOBackups

# Back up a single GPO
Backup-GPO -Name "Default Domain Policy" -Path C:\GPOBackups

# Restore a GPO from backup
Restore-GPO -Name "Default Domain Policy" -Path C:\GPOBackups

# List every GPO with status and last-modified time
Get-GPO -All | Sort-Object DisplayName |
    Select-Object DisplayName, GpoStatus, ModificationTime | Format-Table -AutoSize

# Generate a settings report for one GPO
Get-GPOReport -Name "Default Domain Policy" -ReportType Html -Path C:\Temp\DDP.html

---

Troubleshooting: Common Group Policy Errors

Each row is deep-linkable — share a specific error with …#gp-1058, and the row highlights on arrival.

Error / Event	Meaning	Fix
Event 1058	Cannot access gpt.ini for a GPO	Check DNS, SYSVOL/DFS replication, and that the client can reach a DC
Event 1030	Generic failure to query Group Policy	Usually accompanies 1058 — fix connectivity to SYSVOL, then gpupdate /force
Access is denied	gpresult run without elevation for computer scope	Run the prompt as Administrator, or use /scope user
does not have RSOP data	Policy hasn't applied, or wrong session/scope	Run gpupdate /force, then gpresult /r from the affected user's session
WinRM cannot complete	Invoke-GPUpdate can't reach the target	Run Enable-PSRemoting -Force on the target and allow WinRM through the firewall
Invoke-GPUpdate not recognized	GroupPolicy module not installed	Install RSAT: Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0

---

How Often Does Group Policy Refresh on Its Own?

If you don't run gpupdate, Windows refreshes policy automatically:

• Domain computers and users: every 90 minutes, plus a random offset of 0–30 minutes (so up to 120 minutes).
• Domain controllers: every 5 minutes.
• At startup and logon: computer policy applies at boot, user policy at logon (foreground processing).

gpupdate /force exists so you don't have to wait for that background cycle when you've just changed a policy.

---

Version-Specific Notes

• Windows 11 / 10: gpupdate and gpresult are identical across modern versions. The GroupPolicy module requires RSAT (Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0).
• Windows Server: Invoke-GPUpdate and the full GroupPolicy module ship with the Group Policy Management feature, installed by default on domain controllers.
• Home editions: Windows Home has no Group Policy engine — gpupdate exists but has no domain or local GPO settings to apply.
• Foreground-only policies: software installation, folder redirection, and drive mappings apply only during foreground processing — use /sync or have the user reboot/log off.