gpupdate to refresh user policy: Access Denied error

I am creating a multi-desktop solution, where each desktop has its own
explorer.exe shell, which is created with different user accounts. All of
these desktops are hosted in the same "winsta0" window station of the Console
window session.
For example, if there are 2 desktops, the "Default" desktop is running
user1; "desktop2" is running user2.

If I type "gpupdate" command at user1's desktop (under user1's security
context), it will succeed in refreshing both machine and user1's user policy.
But if I type "gpupdate" command at user2's desktop (under user2's security
context), it will succeed only in refreshing machine policy, but not user2's
user policy with an Access Denied error.

I don't know why it is so. This is my guess: gpupdate (i.e. RefreshPolicy
Win32 API) will check who is the currently logged on user in this window
session(in my case, it is "user1"); if the user that you are trying to
refresh GPO is a different user, then it will reject the request?

Anyone is familiar with how gpupdate or RefreshPolicy API work? Thanks in
advance