Free tools Windows power users keep installed
One-click scans. No signup required.
Group Policy normally processes from Local to Site to Domain, then through parent and child organizational units (OUs). When applicable settings conflict, the one processed later generally wins. A client processes computer policy at startup and user policy at sign-in, then refreshes in the background—by default every 90 minutes with a random offset of up to 30 minutes. A manual gpupdate can request a refresh, but it does not make every setting take effect immediately.
Where does a Group Policy apply?
A Group Policy Object (GPO) affects a user or computer only when it is linked to a relevant Active Directory site, domain, or OU and is in scope for that account or device. Policies are cumulative by default. The normal processing sequence is Local, Site, Domain, then OU links from parent to child. See Microsoft’s Group Policy processing documentation.
As an Amazon Associate I earn from qualifying purchases.
That sequence is a starting point, not proof that a particular GPO applies. The user or computer must be in the linked scope, the relevant user or computer side of the GPO must be enabled, and any applicable scope or filtering conditions must allow it. A policy linked to an OU applies according to the location of the relevant user or computer object in Active Directory; user and computer policy can therefore follow different paths.
Which GPO takes precedence when settings conflict?
For an ordinary conflict, later processing generally wins. A child OU’s applicable setting is processed after settings inherited from its parent, so it can override them. If multiple GPO links are attached to the same container, GPMC’s link order matters: by default, the link with the lowest link-order number has precedence and is processed last.
#1 Best Overall
Two inheritance options can change the ordinary result. They are different controls: Block Inheritance is set on a domain or OU container; Enforced is set on an individual GPO link.
- Block Inheritance: stops ordinary inherited GPOs from higher in the hierarchy from applying below that domain or OU boundary.
- Enforced: protects a GPO link from being blocked by a lower-level Block Inheritance setting and prevents lower-level conflicting settings from overriding that enforced policy.
So, an enforced link from higher in the hierarchy can still apply through a blocked inheritance boundary. For the exact effective result on a device, inspect its links and scope rather than assuming every policy setting behaves as a simple overwrite; policy extensions and setting types can have specialized processing behavior.
What to check when the expected GPO does not win
- Confirm the GPO is linked to the expected site, domain, or OU and that the user or computer object is in scope.
- In GPMC, check link order and whether the link is Enforced.
- Check for Block Inheritance on the relevant domain or OU.
- Verify that the applicable user or computer side of the GPO is enabled and that scope or filtering does not exclude the target.
- Consider whether AD or SYSVOL replication has delivered the change to the domain controller used by the client.
When does Group Policy update?
Group Policy is processed in the foreground at startup for computer settings and at logon for user settings. Between those events, Windows also performs background refreshes. Microsoft’s default for clients and servers is a refresh every 90 minutes, with a random offset of up to 30 minutes; the interval can be configured, so it is not a guaranteed maximum wait. Domain controllers, by default, check computer policy every five minutes. These defaults are documented in Microsoft’s Group Policy processing documentation, last updated June 16, 2025.
There can also be a delay before a changed GPO reaches the domain controller a client contacts. Group Policy data is stored in both Active Directory and SYSVOL, which replicate separately. Microsoft describes default within-site Active Directory replication as typically taking less than a minute, subject to network conditions, and SYSVOL DFSR replication within a site as running every 15 minutes. Inter-site replication depends on the topology and schedule. These are documented defaults and context, not a universal convergence deadline.
Rank #3
Why can a successful refresh have no immediate visible effect?
Not every client-side extension processes settings during background refresh. Microsoft’s processing documentation identifies Folder Redirection as logon-only and Software Installation as requiring startup or logon processing. Scripts run at startup or shutdown, or at logon or logoff, depending on the script type. A refresh can therefore complete without producing a visible change until the required event occurs.
Does gpupdate apply changes immediately?
gpupdate requests a local policy update; by default it updates both computer and user settings. It does not bypass replication delays or the startup, logon, or other processing requirements of a particular extension. Microsoft’s gpupdate command reference documents these options:
| Command or option | What it does |
|---|---|
gpupdate |
Requests an update of both computer and user policy on the local computer. |
/target:computer |
Requests an update for computer policy only. |
/target:user |
Requests an update for user policy only. |
/force |
Reapplies all policy settings rather than applying only settings that have changed. |
/boot |
Restarts the computer when needed to complete processing that requires startup. |
/logoff |
Signs the user out when needed to complete processing that requires logon. |
For example, to request a full local refresh, run gpupdate /force in a Command Prompt. For a setting that needs startup or logon processing, use the appropriate restart or sign-out option, or wait for that event. Administrators can also trigger remote refresh with Invoke-GPUpdate or from GPMC.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How to investigate the effective policy
If a setting is still missing or has an unexpected value, separate the problem into scope, precedence, and timing: confirm that the GPO applies to the correct user or computer; check link order, Enforced, and Block Inheritance; then allow for replication and any required foreground processing. The exact effective policy depends on the directory layout, filtering, configuration, and replication state of the environment.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
