So you need to perform a hard policy reset on a few (or a lot) of ConfigMgr client computers because they seem to be stuck? PowerShell to the rescue!

If you only need to reset policy on a few computers, just run this command

$Computers = Get-Content -Path "C:\Temp\PolicyRefresh.txt";
$Cred = Get-Credential;
ForEach ($Computer in $Computers) { Write-Host "Resetting ConfigMgr client policy on $Computer"; Invoke-WmiMethod -Namespace root\CCM -Class SMS_Client -Name ResetPolicy -ArgumentList '1' -ComputerName $Computer -Credential $Cred -ErrorAction Stop }

But if you have a bunch to wade through or you want logging, status, etc., this script should do the trick.

The full and latest code can be obtained from GitHub.  https://github.com/ChadSimmons/Scripts/blob/default/ConfigMgr/Troubleshooting/Reset-MECMClientPolicy.ps1

################################################################################################# #BOOKMARK: Script Help 
#.SYNOPSIS 
#   Reset-MECMClientPolicy.ps1 
#   Purge existing ConfigMgr client policy (hard reset) and force a full (not delta) policy retrieval 
#.PARAMETER ComputerName 
#   Specifies a computer name, comma separated list of computer names, or file with one computer name per line 
#.PARAMETER Action 


!!! one two skip a few.... !!! 


ForEach($Computer in $ComputerName) {
     $iCount++; Write-Progress -Activity "[$iCount of $TotalCount] Resetting ConfigMgr Client local policy" -Status 
     $Computer $ComputerStatus = [PSCustomObject][ordered]@{ ComputerName = 
     $Computer; Status = $null; Timestamp = Get-Date } 
     try { 
          If ($Cred) { 
               $Client = Get-WmiObject -Class SMS_Client -Namespace root\ccm -List -ComputerName $Computer -ErrorAction Stop -Credential $Cred 
          } Else { 
               $Client = Get-WmiObject -Class SMS_Client -Namespace root\ccm -List -ComputerName $Computer -ErrorAction Stop } 
          } 
     catch { 
          $ComputerStatus.Status = "WMI connection failed" 
          Write-LogMessage -Message "[$Computer] $($ComputerStatus.Status)" -Type Warn -Verbose 
     } 
     If ($Client) { 
          try { 
               $ReturnVal = $Client.ResetPolicy($Gflag)    
               $ComputerStatus.Status = 'ResetPolicy Success' 

...

You’ll get console output like this

And, you’ll get CMTrace style logging like this

And it may even fix the annoying problem when computers won’t report software update deployment status like these.

Thanks Seth for the inspiration and Rob for enduring my testing.