# Deploy governance policies

> Deploy the UiPath Platform Installer Group Policy administrative template to an Active Directory Central Store, then configure and verify the governance policies.

UiPath publishes an administrative template that surfaces the UiPath Platform Installer governance policies in the Windows Group Policy Management Console (GPMC) and in the Local Group Policy Editor. Deploying the template lets you manage those policies from a Group Policy Object (GPO) instead of writing registry values on each machine. For what each policy controls, see [Governance controls](overview.md#governance-controls).

## Prerequisites

- Administrative rights on the machine where you extract and copy the template.
- Write access to the domain System Volume (SYSVOL) share, for a Central Store deployment.
- Group Policy Management Console is installed on the machine you use to edit GPOs.
- Target machines are domain members in an Organizational Unit (OU) that you can link a GPO to.

## Download the administrative template

1. Download the policy template archive:

   ```
   https://download.uipath.com/connected-installer/policy-templates/UiPathPlatformPolicyTemplates.zip
   ```

2. Extract the archive to a local folder on the machine you use for the deployment.

**Result**

The extracted folder contains the template files and a version marker:

```
VERSION
windows/admx/UiPathPlatform.admx
windows/admx/en-US/UiPathPlatform.adml
```

The `windows\admx` folder mirrors the layout of the Windows `PolicyDefinitions` folder, so you copy its contents into a policy store as they are, with no renaming and no restructuring.

The `VERSION` file is a plain-text marker that tells you which release of the template set you downloaded. Windows does not read it. Use it to check whether the published archive is newer than the template you deployed previously. To update an existing deployment, repeat the steps in this page with the newer archive and overwrite the files already in the policy store.

## Deploy to an Active Directory Central Store

The Central Store is the domain-replicated location for administrative templates. Once the template is in the Central Store, every machine that runs GPMC against the domain picks it up, with no per-workstation installation.

1. Open a PowerShell session as an administrator on a machine that can write to SYSVOL, such as a domain controller.
2. Change to the folder where you extracted the archive.
3. Set a variable for the Central Store path, replacing `<domain-fqdn>` with your domain name, for example `corp.example.com`:

   ```powershell
   $central = "\\<domain-fqdn>\SYSVOL\<domain-fqdn>\Policies\PolicyDefinitions"
   ```

4. Create the Central Store folders if your domain does not have a Central Store yet:

   ```powershell
   New-Item -ItemType Directory -Path $central -Force | Out-Null
   New-Item -ItemType Directory -Path "$central\en-US" -Force | Out-Null
   ```

5. Copy the contents of `windows\admx` from the extracted folder into the Central Store:

   ```powershell
   Copy-Item .\windows\admx\UiPathPlatform.admx -Destination $central -Force
   Copy-Item .\windows\admx\en-US\UiPathPlatform.adml -Destination "$central\en-US" -Force
   ```

:::note
When you create a Central Store for the first time, also copy the contents of `%SystemRoot%\PolicyDefinitions` from a machine running your reference Windows version into the Central Store. Otherwise GPMC shows only the UiPath policies. For details, see [Create and Manage Central Store](https://learn.microsoft.com/troubleshoot/windows-client/group-policy/create-and-manage-central-store) in the Microsoft documentation.
:::

**Result**

The template files are in the Central Store and replicate to the other domain controllers in the domain. GPMC now offers a **UiPath > Platform Installer** node under Administrative Templates.

## Deploy on a single machine for testing

To evaluate the policies without a domain, copy the template into the local policy store on one machine.

1. Open a PowerShell session as an administrator on the test machine.
2. Change to the folder where you extracted the archive.
3. Copy the contents of `windows\admx` from the extracted folder into the local policy store:

   ```powershell
   Copy-Item .\windows\admx\UiPathPlatform.admx -Destination "$env:SystemRoot\PolicyDefinitions" -Force
   Copy-Item .\windows\admx\en-US\UiPathPlatform.adml -Destination "$env:SystemRoot\PolicyDefinitions\en-US" -Force
   ```

4. Open the Local Group Policy Editor:

   ```powershell
   gpedit.msc
   ```

:::note
`gpedit.msc` is available only on the Pro, Enterprise, and Server editions of Windows. On Home editions, use a Central Store deployment instead.
:::

**Result**

The Local Group Policy Editor shows the UiPath policies for this machine only. Settings configured here are not replicated to other machines.

## Configure the policies

Configure the policies in a GPO, then link that GPO to the OU that holds the target machines. All UiPath Platform Installer policies are Computer scope; there are no per-user settings.

Each policy writes one registry value on the target machine:

| Policy in the Group Policy editor | Registry value |
|---|---|
| Update channel | `Channel` |
| Artifact download root URL | `DownloadRootLocation` |
| Maximum postpone days before forced upgrade | `MaxPostponeDays` |
| Maximum allowed platform version | `MaxAllowedVersion` |
| Disable automatic platform updates | `AutoUpdateDisabled` |

1. Run `gpmc.msc` on a machine that has the Group Policy Management Console installed.
2. Create a GPO for the installer policies, or open an existing GPO for editing.
3. Navigate to **Computer Configuration > Policies > Administrative Templates > UiPath > Platform Installer**.
4. Open the policy you want to set.
5. Select **Enabled**.
6. Enter the value for the policy, such as the channel name, download root URL, maximum version, or number of days. **Disable automatic platform updates** has no value field, so selecting **Enabled** is sufficient to turn automatic updates off.
7. Select **OK**.
8. Repeat steps 4 through 7 for each policy you want to set.
9. Close the Group Policy editor.
10. In GPMC, open the context menu for the OU that holds the target machines and select **Link an Existing GPO**.
11. Select the GPO you configured and select **OK**.

:::note
A policy left **Not Configured** removes its registry value on target machines, and UiPath Platform Installer falls back to its default behavior for that setting. For **Disable automatic platform updates**, selecting **Disabled** explicitly turns automatic updates on.
:::

**Result**

The GPO is linked to the OU. Machines in that OU, and in its child OUs through inheritance, receive the configured policies at their next policy refresh.

## Verify the applied policies

1. Sign in to a target machine with administrative rights.
2. Force an immediate policy refresh:

   ```powershell
   gpupdate /target:computer /force
   ```

3. Read the resulting registry values:

   ```powershell
   Get-ItemProperty "HKLM:\SOFTWARE\Policies\UiPath\Platform"
   ```

**Result**

The output lists one entry for each policy you configured, named as shown in the preceding table. Policies left **Not Configured** are absent from the output. UiPath Platform Installer reads these values on its next update check.