Windows 11--most recently opened Explorer window keeps popping up into the foreground

You can force the process in a CMD with "gpupdate /force".
GPO will be triggered any 90 minutes.

So, if the GPO is the issue, this should also happen if you force them.

I can not confirm, that this issue is in touch with the GPO sync, since I do have this once a day or less, while others do have this more often, but none of them once with any GPO run...

Okay, this issue is now reproducible via the following steps:

1. EDIT: First, ensure there are no Explorer windows open.
2. Open Explorer - leave it open and do not minimise it.
3. Open a CMD/Terminal window.
4. Type the following and press return: gpupdate /force

Expected: Group Policy updates and nothing else happens.

Actual: The terminal read-out shows "Updating policy..." and then the Explorer window pops over the top of the terminal window.

As such, I agree this seems to relate to GP updates.

Well spotted!

The only thing I could mention, that is similar to anybody in my env is, that anybody has Trellix (McAfee) products installed and that anybody runs Microsoft Teams.

I am running MS Teams at work, but not on my Home PC (seen the issue on both). No McAfee.

So, i tried gpupdate /force and the explorer window immediately popped into the foreground on the first run. Any consecutive runs did nothing. So i am now even more sure that group policies is the culprit, but this could also just be good timing too. Gonna try a few times to check if i can make this even more reproducible.

Works only if i do the exact steps there, new explorer windows, DONT minimise it, then do the update.

but this issue happens even when explorer windows are minimised, so i don't think this is the whole story, but perhaps making steps towards it at least!

What are your AntiVirus solutions? Mine is Trellix/Mcafee, with a full set of Mvision, EDR, DLP and all the good things....

I have to check with the admins. I haven't detected a antivirus system yet, but can see in task manager list that has: 'antimalware service executable'. I can see in the apps list here a 'windows security' app. And also, in task manager list - I can see something that says 'webthreatdefense'.

I'll ask the admins what antivirus they have installed into our systems. Thanks again!

Do NOT use an elevation tool, it has to run in your Users context. If you elevate the CMD it will happen in session 0 and you will not get a result, if this is a connected issue. Also you will not get RSOP data for the User in session 0

@OC: Are you the admin by yourself?

Thanks for mentioning that Michael! I just tried the gupdate /force again even after the 'make me admin' expired. No pop-ups.

In non-elevated mode, I closed the previous cmd window, just in case, and started up a new cmd window in non-elevated mode. No pop-ups. At this stage, I'll be happy to try anything - even to just reproduce the pop-ups, so that I can get the admins to just try anything. I get the explorer pop-ups happening at least one time every day. It is right up there with one of the weirdest situations ever. The nice thing is that at least some people - such as yourself is getting something reproducible on your side.

Our computers are networked - our PC (actually laptops) are networked, and running the Windows 11. Interestingly, it seems that other people here aren't having the same issue. It's just weird how I got the 'short end' of the straw after the Windows 11 update (after being on Windows 10).

Cannot reproduce it on mine. I do have Teams, OneDrive, Outlook running and experience this occasional pop up every day.

Me too. I did the test too. I made sure I had explorer windows in the background - not minimised. And I even opened up Team - just to add that into the mix. And then made sure my 'make me admin' thing is running, and then applied that the gpupdate /force (in the CMD window), and just to make sure everything was in the 'background', I clicked on a powerpoint window to make that powerpoint window the foreground.

Just reporting, with the CMD window in foreground, and then the powerpoint window just behind that, and the rest (eg. explorer windows) behind that (no minimised) --- doing the gpupdate /force didn't make my explorer windows pop to the foreground.