Windows 2000 Group Policy Refresh Intervals

In Microsoft Windows 2000, Group Policy objects (GPOs) are applied to domain-joined computers not only during system startup and user logon, but also at recurring background intervals. This article explains the underlying mechanism Windows 2000 uses to execute these periodic background updates, detailing default refresh schedules, the role of the Winlogon process, the randomization offset used to prevent network congestion, and how policy changes are detected and enforced.

The Winlogon Background Thread

In Windows 2000, the execution of Group Policy is managed by the Winlogon process (winlogon.exe). During system initialization, Winlogon spawns a background thread responsible for monitoring policy timers. This thread sets a system timer that periodically triggers an evaluation of the Active Directory environment to check for newly applied or modified GPOs without requiring a system reboot or user logoff.

Default Refresh Intervals

Windows 2000 differentiates between standard domain-joined machines (workstations and member servers) and Domain Controllers (DCs) when determining refresh frequency:

  • Workstations and Member Servers: The default base refresh interval is 90 minutes.
  • Domain Controllers: Because DCs are critical to directory services and authentication, they utilize a much more frequent default interval of 5 minutes.

The Randomized Offset Mechanism

To prevent an issue known as the "network storm" or "DC hammering"—where hundreds or thousands of clients simultaneously query the Domain Controller for updates—Windows 2000 introduces a randomized offset.

For standard member computers, Windows 2000 automatically adds a random duration of 0 to 30 minutes to the base 90-minute timer. As a result, standard domain-joined machines refresh their Group Policy settings at unpredictable intervals ranging between 90 and 120 minutes. Domain Controllers do not utilize a large randomization window because of their short 5-minute cycle.

Change Detection and Application

When the background timer expires, Winlogon initiates the policy retrieval sequence:

  1. GPO Version Comparison: The client queries Active Directory and the SYSVOL share to read the version number of all assigned GPOs.
  2. Delta Processing: If the version numbers in Active Directory match the locally cached version numbers from the previous refresh, Winlogon determines that no changes have occurred and terminates the process, conserving network and CPU resources.
  3. Client-Side Extension (CSE) Execution: If a version increment is detected, Winlogon invokes the appropriate Client-Side Extensions (such as Administrative Templates, Scripts, or Security Settings) to apply the modified settings to the local registry and system state.

Exceptions to Background Refreshes

Not all Group Policy components can be executed during a periodic background refresh in Windows 2000. Specifically:

  • Software Installation: Applications deployed via Group Policy require a clean boot state and are only installed during system startup.
  • Folder Redirection: Modifying user shell folders occurs strictly during user logon to prevent file-locking conflicts while the user is actively working.

Manual Refreshes and Custom Configuration

System administrators can modify the background refresh interval using administrative template policies or directly in the Windows 2000 registry under:

HKLM\Software\Policies\Microsoft\Windows\System

Key values include GroupPolicyRefreshTime (base interval in minutes) and GroupPolicyRefreshTimeOffset (maximum random offset in minutes).

To trigger an immediate manual refresh on a Windows 2000 machine without waiting for the background timer, administrators use the command-line utility secedit.exe using the syntax:

secedit /refreshpolicy machine_policy /enforce (for computer settings)
secedit /refreshpolicy user_policy /enforce (for user settings)