Update

vendor/tailscale.com/util/winutil/gp/gp_windows.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 // Package gp contains [Group Policy]-related functions and types.
@@ -9,6 +9,7 @@ package gp
 import (
 	"fmt"
 	"runtime"
+	"unsafe"
 
 	"golang.org/x/sys/windows"
 )
@@ -77,3 +78,14 @@ func toRefreshPolicyFlags(force bool) uint32 {
 	}
 	return 0
 }
+
+var mgmtProductTailscale = unsafe.SliceData([]uint16{'T', 'a', 'i', 'l', 's', 'c', 'a', 'l', 'e', 0})
+
+// NotifyMachinePolicyChange sends a machine-scoped group policy change
+// notification which Windows broadcasts to group policy change subscribers.
+// The caller must be running as LocalSystem.
+func NotifyMachinePolicyChange() error {
+	// GenerateGPNotification is quasi-documented. Note that its implementation
+	// contains an access check ensuring that the calling user is LocalSystem!
+	return generateGPNotification(true, mgmtProductTailscale, 0)
+}

vendor/tailscale.com/util/winutil/gp/mksyscall.go

@@ -1,11 +1,14 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
+//lint:file-ignore ST1000 see gp_windows.go
+
 package gp
 
 //go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go mksyscall.go
 
 //sys enterCriticalPolicySection(machine bool) (handle policyLockHandle, err error) [int32(failretval)==0] = userenv.EnterCriticalPolicySection
+//sys generateGPNotification(machine bool, mgmtProduct *uint16, mgmtProductOptions uint32) (ret error) = userenv.GenerateGPNotification?
 //sys impersonateLoggedOnUser(token windows.Token) (err error) [int32(failretval)==0] = advapi32.ImpersonateLoggedOnUser
 //sys leaveCriticalPolicySection(handle policyLockHandle) (err error) [int32(failretval)==0] = userenv.LeaveCriticalPolicySection
 //sys registerGPNotification(event windows.Handle, machine bool) (err error) [int32(failretval)==0] = userenv.RegisterGPNotification

vendor/tailscale.com/util/winutil/gp/policylock_windows.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 package gp

vendor/tailscale.com/util/winutil/gp/watcher_windows.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 package gp

vendor/tailscale.com/util/winutil/gp/zsyscall_windows.go

@@ -43,6 +43,7 @@ var (
 
 	procImpersonateLoggedOnUser    = modadvapi32.NewProc("ImpersonateLoggedOnUser")
 	procEnterCriticalPolicySection = moduserenv.NewProc("EnterCriticalPolicySection")
+	procGenerateGPNotification     = moduserenv.NewProc("GenerateGPNotification")
 	procLeaveCriticalPolicySection = moduserenv.NewProc("LeaveCriticalPolicySection")
 	procRefreshPolicyEx            = moduserenv.NewProc("RefreshPolicyEx")
 	procRegisterGPNotification     = moduserenv.NewProc("RegisterGPNotification")
@@ -70,6 +71,22 @@ func enterCriticalPolicySection(machine bool) (handle policyLockHandle, err erro
 	return
 }
 
+func generateGPNotification(machine bool, mgmtProduct *uint16, mgmtProductOptions uint32) (ret error) {
+	ret = procGenerateGPNotification.Find()
+	if ret != nil {
+		return
+	}
+	var _p0 uint32
+	if machine {
+		_p0 = 1
+	}
+	r0, _, _ := syscall.SyscallN(procGenerateGPNotification.Addr(), uintptr(_p0), uintptr(unsafe.Pointer(mgmtProduct)), uintptr(mgmtProductOptions))
+	if r0 != 0 {
+		ret = syscall.Errno(r0)
+	}
+	return
+}
+
 func leaveCriticalPolicySection(handle policyLockHandle) (err error) {
 	r1, _, e1 := syscall.SyscallN(procLeaveCriticalPolicySection.Addr(), uintptr(handle))
 	if int32(r1) == 0 {