Home / server / Questions / 644620
Accepted
Stef
Asked: 2014-11-16 09:38:24 +0800 CST

gpupdate doesn't work on everything

  • 772

On a Win2008 Domain Controller, I've changed an user account property "Account is sensitive..."

Of course, I want that GPO to apply immediately

So I try gpupdate (or gpupdate /force), but it doesn't seem to work !?

I have to reboot my domain computer, then logon again with the user account to make it work !?

Another way ?

The solution is here Is there a way to refresh computer group membership without rebooting?

windows-server-2008

1 Answers

  1. Best Answer

    As already commented, the "Account is sensitive and cannot be delegated" flag is a user account attribute, not a GPO setting.

    If you've checked this box and want to make sure that the change is immediately replicated everywhere, you can use repadmin to force it:

    repadmin /replsingleobj * source-dc01.domain.tld CN=SensitiveUser,OU=Users,DC=domain,DC=tld
    • 5