![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 28.000000000000004%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECW%3C/text%3E%3C/svg%3E)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 81%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECT%3C/text%3E%3C/svg%3E)
Hello Chris,
Thank you for posting question on Microsoft Windows Forum!
Based on the issue description. This symptom might be associated with the Network Location Awareness (NLA) service. On Windows Server 2025 (and earlier versions), NLA sometimes attempts to identify the network category before the network interface has fully initialized or before it can contact a Domain Controller (DC). When it fails to find a DC, it defaults to the Public profile, which then blocks the very traffic needed for Group Policy processing. Since gpupdate /force is asking for a reboot, it probably has "Synchronous" policies (like Software Installation or Folder Redirection) pending that require a clean boot-time connection that is not happening.
The suggestion here is to ensure the NLA service waits until the stack is fully ready before it attempts to categorize the network. you can open Services.msc. Locate Network Location Awareness. Change the Startup type to Automatic (Delayed Start). Also considering to do the same for the Network List Service.
Another point to consider is to configure "Always wait for the network". There is a specific Group Policy setting designed to force Windows to wait for a valid network connection before attempting to process GPOs or log a user in. Navigating to this Path Computer Configuration > Administrative Templates > System > Group Policy Look for the Setting: Specify startup policy processing wait time and set the value to 30–60 seconds and look for Setting: Always wait for the network at computer startup and logon and set value to Enabled. Please note: Try the above settings in a testing environment first.
You can consult the following articles for more information regarding your concerns.
- https://techcommunity.microsoft.com/discussions/windowsserverinsiders/server-2025-core-adds-dc-network-profile-showing-as-public-and-not-as-domainauth/4125017
- https://techcommunity.microsoft.com/discussions/windowsserverinsiders/domain-controller-showing-network-connection-as-public/3948439
Hope the above information is helpful! If it is. Free feel to hit "Accepted" for benefitting others in community having the same issue too.