[SOLVED] GPUDATE /FORCE DOESN'T WORK WITH GLOBAL PROTECT

DanielS.Romero — Sun, 10 May 2026 00:08:09 GMT

Hello LiveCommunity Team!

I created this post to share my experience regarding an issue involving GlobalProtect users from Prisma Access who attempt to run gpupdate /force to update GPO policies from the DC server, and who encounter the following error:

CMD ERROR GPUPDATE /FORCE
C:\WINDOWS\system32>gpupdate /force

Updating policy...

User policy cannot be updated successfully due to the following errors:

Group policy cannot be processed because it cannot connect to a domain controller over the network. This condition may be temporary. A success message may be generated once the computer connects to the domain controller and the group policy is processed successfully. Contact your administrator.

- Given this error, I checked the GlobalProtect source IP logs and everything appeared to be allowed.

Then, I tried pinging from an affected endpoint with a custom length and the DF "Don't Fragment" bit active set to 1350 bytes, and the ping was dropped by fragmentation needed. as shown below:

PING TEST WITH 1350 BYTES

Then I try it with 1300 Bytes as the payload and the ping works!

PING TEST WITH 1300 BYTES

So, as a test, I changed the Prisma Access GlobalProtect tunnel MTU to 1300 bytes (default is 1400 bytes) and the gpupdate /force command works!

PRISMA ACCESS GLOBAL PROTECT CONNECTION MTU ADJUSTMENT FROM 1400 TO 1300 BYTES

CMD GPUPDATE /FORCE SUCCESFULLY

C:\Users\pcmolinaa>gpupdate /force
Updating policy...

The computer policy update completed successfully.

Conclusions:

- Some device in the path, most likely the on-premises NGFW, was dropping the LDAP packets because it has a lower MTU and the packets are sent with the DF bit set, disabling IP fragmentation and forcing the drop by some peer.

Thank you for your time, and I hope this information is helpful in your daily cybersecurity work. I would greatly appreciate your support by liking or accepting this as a useful post; it would help me a lot in becoming a CyberElite!

Best Regards,

Daniel Romero
Senior Network/Security Engineer
PANW Partner

topic [SOLVED] GPUDATE /FORCE DOESN'T WORK WITH GLOBAL PROTECT in GlobalProtect Discussions

[SOLVED] GPUDATE /FORCE DOESN'T WORK WITH GLOBAL PROTECT