Cache Refresh is a 'pull' method; that means you can 'pull' user's information from backend Active Directory or LDAP.
Gluu Server don't have 'root' write access to AD. Whatever change of user's information you want to make; you have to do that in backend AD, then Gluu Server will 'pull' that user's information from Active directory.
Yes, there are couple of scripts which you can use to 'sync' changed password from Gluu Server to AD but we don't suggest you to use that; better use SCIM in that case.
Let me know if you have any question or confusion please.