Deploy governance policies

Deploy the UiPath Platform Installer Group Policy administrative template to an Active Directory Central Store, then configure and verify the governance policies.

UiPath publishes an administrative template that surfaces the UiPath Platform Installer governance policies in the Windows Group Policy Management Console (GPMC) and in the Local Group Policy Editor. Deploying the template lets you manage those policies from a Group Policy Object (GPO) instead of writing registry values on each machine. For what each policy controls, see Governance controls.

Prerequisites

• Administrative rights on the machine where you extract and copy the template.
• Write access to the domain System Volume (SYSVOL) share, for a Central Store deployment.
• Group Policy Management Console is installed on the machine you use to edit GPOs.
• Target machines are domain members in an Organizational Unit (OU) that you can link a GPO to.

Download the administrative template

1. Download the policy template archive:

   https://download.uipath.com/connected-installer/policy-templates/UiPathPlatformPolicyTemplates.zip
   

2. Extract the archive to a local folder on the machine you use for the deployment.

Result

The extracted folder contains the template files and a version marker:

VERSION
windows/admx/UiPathPlatform.admx
windows/admx/en-US/UiPathPlatform.adml

The windows\admx folder mirrors the layout of the Windows PolicyDefinitions folder, so you copy its contents into a policy store as they are, with no renaming and no restructuring.

The VERSION file is a plain-text marker that tells you which release of the template set you downloaded. Windows does not read it. Use it to check whether the published archive is newer than the template you deployed previously. To update an existing deployment, repeat the steps in this page with the newer archive and overwrite the files already in the policy store.

Deploy to an Active Directory Central Store

The Central Store is the domain-replicated location for administrative templates. Once the template is in the Central Store, every machine that runs GPMC against the domain picks it up, with no per-workstation installation.

1. Open a PowerShell session as an administrator on a machine that can write to SYSVOL, such as a domain controller.

2. Change to the folder where you extracted the archive.

3. Set a variable for the Central Store path, replacing <domain-fqdn> with your domain name, for example corp.example.com:

   $central = "\\<domain-fqdn>\SYSVOL\<domain-fqdn>\Policies\PolicyDefinitions"
   

4. Create the Central Store folders if your domain does not have a Central Store yet:

   New-Item -ItemType Directory -Path $central -Force | Out-Null
   New-Item -ItemType Directory -Path "$central\en-US" -Force | Out-Null
   

5. Copy the contents of windows\admx from the extracted folder into the Central Store:

   Copy-Item .\windows\admx\UiPathPlatform.admx -Destination $central -Force
   Copy-Item .\windows\admx\en-US\UiPathPlatform.adml -Destination "$central\en-US" -Force
   

Note:

When you create a Central Store for the first time, also copy the contents of %SystemRoot%\PolicyDefinitions from a machine running your reference Windows version into the Central Store. Otherwise GPMC shows only the UiPath policies. For details, see Create and Manage Central Store in the Microsoft documentation.

Result

The template files are in the Central Store and replicate to the other domain controllers in the domain. GPMC now offers a UiPath > Platform Installer node under Administrative Templates.

Deploy on a single machine for testing

To evaluate the policies without a domain, copy the template into the local policy store on one machine.

1. Open a PowerShell session as an administrator on the test machine.

2. Change to the folder where you extracted the archive.

3. Copy the contents of windows\admx from the extracted folder into the local policy store:

   Copy-Item .\windows\admx\UiPathPlatform.admx -Destination "$env:SystemRoot\PolicyDefinitions" -Force
   Copy-Item .\windows\admx\en-US\UiPathPlatform.adml -Destination "$env:SystemRoot\PolicyDefinitions\en-US" -Force
   

4. Open the Local Group Policy Editor:

   gpedit.msc
   

Note:

gpedit.msc is available only on the Pro, Enterprise, and Server editions of Windows. On Home editions, use a Central Store deployment instead.

Result

The Local Group Policy Editor shows the UiPath policies for this machine only. Settings configured here are not replicated to other machines.

Configure the policies

Configure the policies in a GPO, then link that GPO to the OU that holds the target machines. All UiPath Platform Installer policies are Computer scope; there are no per-user settings.

Each policy writes one registry value on the target machine:

Policy in the Group Policy editor	Registry value
Update channel	Channel
Artifact download root URL	DownloadRootLocation
Maximum postpone days before forced upgrade	MaxPostponeDays
Maximum allowed platform version	MaxAllowedVersion
Disable automatic platform updates	AutoUpdateDisabled

1. Run gpmc.msc on a machine that has the Group Policy Management Console installed.
2. Create a GPO for the installer policies, or open an existing GPO for editing.
3. Navigate to Computer Configuration > Policies > Administrative Templates > UiPath > Platform Installer.
4. Open the policy you want to set.
5. Select Enabled.
6. Enter the value for the policy, such as the channel name, download root URL, maximum version, or number of days. Disable automatic platform updates has no value field, so selecting Enabled is sufficient to turn automatic updates off.
7. Select OK.
8. Repeat steps 4 through 7 for each policy you want to set.
9. Close the Group Policy editor.
10. In GPMC, open the context menu for the OU that holds the target machines and select Link an Existing GPO.
11. Select the GPO you configured and select OK.

Note:

A policy left Not Configured removes its registry value on target machines, and UiPath Platform Installer falls back to its default behavior for that setting. For Disable automatic platform updates, selecting Disabled explicitly turns automatic updates on.

Result

The GPO is linked to the OU. Machines in that OU, and in its child OUs through inheritance, receive the configured policies at their next policy refresh.

Verify the applied policies

1. Sign in to a target machine with administrative rights.

2. Force an immediate policy refresh:

   gpupdate /target:computer /force
   

3. Read the resulting registry values:

   Get-ItemProperty "HKLM:\SOFTWARE\Policies\UiPath\Platform"
   

Result

The output lists one entry for each policy you configured, named as shown in the preceding table. Policies left Not Configured are absent from the output. UiPath Platform Installer reads these values on its next update check.