7

Every time I request a permission change the IT group at my company instructs me to wait 20 minutes and reboot the computer. I cannot believe that in this day and age you still need to reboot the computer to clear whatever cache stores the permissions locally. It feels like something out of the NT 4 days.

  • Do you actually still need to reboot the computer?
  • Is a logout/login sufficient?
  • Is there still a long time(20 minutes) for the changes to propagate through the AD tree?

4 Answers 4

7

It depends on what the "permission change" is. If they are adding you to a group, you will need to log off/on to effect the change. If they are adding your account, or a group you are already in, to a resource, you wouldn't need to to log off/on.

FYI: If the change is to a machine policy (which can be indirectly via loopback processing), you will need to reboot.

3
  • Relevant: serverfault.com/a/660184/156647
    – Brad
    Dec 21, 2015 at 17:59
  • NB: It may be possible using this trick: woshub.com/…: klist tgt. NB: I've not tested this myself; just going off the info in the article.
    – JohnLBevan
    Jul 5, 2018 at 9:07
  • @JohnLBevan - While it's possible, I've yet to come across a circumstance where it wasn't more efficient just to have the user log off/on. YMMV.
    – Chris
    Jul 27, 2018 at 19:58
2

Running gpupdate /force then logging out then in should be fine.

1

Normally a logout/login should be sufficient.

gpupdate - as mentioned in another answer - will not be enough.

Most likely your IT department manages permissions with group memberships. And those are only updated on logon.

The 20 minutes are due to the default replication frequency of 15 minutes. This could be improved by enabling change notifications.

2
  • 1
    The other answer mentions both gpupdate and logging out then in...
    – soandos
    Dec 23, 2011 at 16:50
  • Oh. I think I shouldn't post answers when I'm too tired...
    – mich732
    Dec 23, 2011 at 20:29
0

http://msdn.microsoft.com/en-us/library/how-global-catalog-servers-work(v=ws.10).aspx Cache Refresh and the Availability of Group Changes

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.