For W2K computers in a Windows 2000 domain, computer and group policies are applied when one starts the computer and when one logs onto a Windows 2000 domain. Using the registry, an administrator can specify whether a group policy should be refreshed in the background, and if so, at what intervals. If you have a large number of workstations and/or member servers, group policy refresh requests can put a significant load on domain controllers. By default, if the administrator has not modified the default registry setting, Windows 2000 workstations and member servers have a 90-minute interval. Domain controllers have a 5 minute interval to insure that they have current policies as replication occurs.

To avoid the performance degradation that would occur if many workstations and/or member server request a group policy refresh simultaneously, a random offset interval is added to the refresh interval to determine the total amount of time between group policy application cycles. The valid range for the offset interval is 0 to 1440 minutes (24 hours). The default offset interval for W2K workstations and member servers is 30 minutes, while the default for domain controllers is 0 minutes.

There are computer and user group policies. There are computer and user group policy intervals for background refresh. These registry values can be disabled or modified locally but remember that local registry settings can be overridden by a GPO in Active Directory.

To control the refresh interval for W2K workstations/member server computer group policies:

Hive: HKEY_LOCAL_MACHINE
Key: Software\Policies\Microsoft\Windows\System
Name: GroupPolicyRefreshTime
Type: REG_DWORD
Value: 0 - 64800 minutes

To control the offset interval for W2K workstations/member servers computer group policies:

Hive: HKEY_LOCAL_MACHINE
Key: Software\Policies\Microsoft\Windows\System
Name: GroupPolicyRefreshTimeOffset
Type: REG_DWORD
Value: 0 - 1440 minutes

To control the refresh interval for domain controllers:

Hive: HKEY_LOCAL_MACHINE
Key: Software\Policies\Microsoft\Windows\System
Name: GroupPolicyRefreshTimeDC
Type: REG_DWORD
Value: 0 - 64800 minutes

To change the offset interval for domain controllers:

Hive: HKEY_LOCAL_MACHINE
Key: Software\Policies\Microsoft\Windows\System
Name: GroupPolicyRefreshTimeOffsetDC
Type: REG_DWORD
Value: 0 - 1440 minutes

To change the refresh interval for user policies:

Hive: HKEY_CURRENT_USER
Key: Software\Policies\Microsoft\Windows\System
Name: GroupPolicyRefreshTime
Type: REG_DWORD
Value: 0 - 64800 minutes

To change the offset interval for user policies:

Hive: HKEY_CURRENT_USER
Key: Software\Policies\Microsoft\Windows\System
Name: GroupPolicyRefreshTimeOffset
Type: REG_DWORD
Value: 0 - 1440 minutes

If you would rather not modify the registry directly, you can use the MMC console. To control the Refresh and Offset Intervals:

• Log on as an administrator
• Click Start
• Click Settings
• Click Control Panel
• Double-click Administrative Tools
• Double-click Computer Management
• Double-click System Tools
• Double-click Group Policy
• Double-click Computer Configuration
• Double-click Administrative Templates
• Double-click System
• Double-click Group Policy to display the group policy behavior policies
• Double-click Group Policy refresh interval for computers to make this change for workstations or member servers
  - or -
  Double-click Group Policy refresh interval for domain controllers
• Click to select the Group Policy refresh interval for computers check box so that you are able to modify the refresh and offset intervals settings on the Policy tab. - or -
  Click to select the Disable background refresh of group policy check box in the Disable background refresh of group policy behavior policy.
• Click OK
• Click Quit the Computer Management snap-in.

Using a Group Policy Object (GPO) to Change the Behavior of Multiple Computers :

• Log on to the W2K computer as an administrator
• Click Start
• Click Settings
• Click Control Panel
• Double-click Administrative Tools
• Double-click Directory Management to modify this at the domain or organizational unit levels
  - or -
  Double-click Active Directory Sites and Services Manager to modify this at a site level
• Edit the GPO on the container where the GPO resides
• Double-click Computer Configuration
• Double-click Administrative Templates
• Double-click System
• Double-click Group Policy to display the group policy behavior policies
• Double-click the appropriate policy
• Click to select the Group Policy refresh interval for computers check box so that you are able to modify the refresh and offset intervals settings on the Policy tab.
  - or -
  Click to select the Disable background refresh of group policy check box in the Disable background refresh of group policy behavior policy.
• Click OK
• Quit the Group Policy Editor snap-in.

If you are an administrator or workstation support and want to insure that the box you are working on has current group policies applied, you can immediately enforce them using the secedit command:

• computer policies:

  secedit /refreshpolicy machine_policy /enforce

• user policies:

  secedit /refreshpolicy user_policy /enforce

Keywords: Windows 2000 Registry Tip, Windows XP, computer, user, group policies, windows 2000 domain, group policy refresh interval, GroupPolicyRefreshTime, GroupPolicyRefreshTimeOffset, GPO, group policy object