Refresh Active Directory group memeberships WITHOUT rebooting

A common issue when updating group memberships in AD is that they do not seem to take effect right away. This is due to Kerberos tokens being used that were created before the group memberships were changed.

The standard way to fix this is to start a new session. With a user object this means a log off and log on; inelegant but not terrible. For a computer object there is no log on and off, the authentication happens when the computer authenticates against a domain controller and thus the fix is to restart the machine. This is not an option for production servers where uptime is critical.


So you've just deployed some new group policies based on some new group memberships you've created and you need those settings applied to production servers but a reboot is out of the question. The policy is not applying.

The solution without a reboot? Deleting existing tokens and forcing them to be recreated.


Open a cmd prompt and run the following two commands:

klist purge

klist tgt

This will delete the tokens and then recreate new ones. Your policy will now apply as expected and there was no reboot necessary!