"Apply once and do not reapply": how it works & how to reapply a second time

Question

1. How does the PC know/determine to apply the GPO (Group Policy Object) Preference item only once?
2. Is there a way you can reapply it a second or subsequent times?

Answer 1

Group Policy Preferences items have a 'Apply once and do not reapply' which is useful if you want to do something once, but not repeatedly if it slows down login or general PC usage since group policy also updates in the background. However you MAY be a need to run it again occasionally like deleting all printers on a PC once, then adding a fresh one.

1-HOW it applies only once

This Microsoft page details how a unique GU(ID) is created then saved in the below registry location on a PC so it knows its been applied once. Thus when group policy updates again it looks for that registry key ID, if it exists it will not run because it has already once.

• HKCU\Software\Microsoft\Group Policy\Client\RunOnce for User Configuration policy
• HKLM\Software\Microsoft\Group Policy\Client\RunOnce for Computer Configuration policy

2-REAPPLY a Group Policy Preference that is configured to apply once

1. Open Group Policy Management
2. Edit the GPO (Group Policy Object) that has the Preference item where 'Apply once and do not reapply' is checked
3. Right-click preference item, All Tasks, Display Xml. In the XML file that opens locate the <FilterRunOnce id line then copy the ID that is in quotes, example: {195A8F33-964D-4CGG-923F-3B3AE7775A2E}
4. Delete that item in the registry which will cause the PC to apply once more. Ways to do that:

   • reg delete "HKCU\SOFTWARE\Microsoft\Group Policy\Client\RunOnce" /v {195A8F11-938D-4CFF-973F-3B3AE8885A2E} /f

     If you put this is a logon script it will cause it to reapply preference item EACH logon, meaning it'll cancel out you checking 'Apply once and do not reapply'. Thus you'd have to build some logic so the script exists if its run before

   • Ironically create a GPO preference Registry item that will delete the key, be sure to set 'Apply once and do not reapply' on this item!

     

Citations: this serverfault answer linked to this site which explained this. I just fleshed it out more here in case link breaks

Answer 2

A unique ID is generated when you check the "Apply once" checkbox. Windows stores this ID to remember if the corresponding Preference was already applied.

"Where" this ID is stored and "How" Windows checks if the ID is already stored are implementation details that may vary depending on the version of Windows.

[MS-GPPREF]: Group Policy: Preferences Extension Data Structure 2.2.1.22 Targeting doesn't specify where this should be stored:

FilterRunOnce
id (required)
MUST be a unique value that will be stored on the machine when the filter processes.

If you need to apply an "Apply Once" Preference again you can Edit the preference, uncheck the "Apply Once" checkbox, click Apply, check the "Apply Once" checkbox, click Apply again. This will generate a new ID.