Group Policy you can finally read, baseline, and keep from drifting
You know the spot. Two machines behave differently, and you’re exporting registry hives into BeyondCompare or diffing gpresult HTML files like a caveman, hunting the one setting that’s off. There’s no source of truth for “what should this box look like” - just a pile of GPOs, a pile of tattooed registry, and your memory.
Conformance (it used to be called Config Baselines) is RFF’s answer: a baseline of desired state that you can read, version, assign to a group, and diff the whole fleet against - in plain English, down to which GPO set each value. No scripts. No DSL. Infrastructure-as-code for endpoints, without the code.
Start free → · No credit card · Up in minutes
Three ways to get a baseline
Capture a golden box. Point Conformance at a known-good machine and it captures its effective Group Policy - the resolved values, read from RSoP, not a registry firehose. That becomes your baseline.
Or author it straight from ADMX. The Settings Catalog parses your own PolicyDefinitions (or any vendor’s ADMX) into a searchable catalog - pick Enabled / Disabled / Not configured like gpedit, see the exact registry writes, and add it to a baseline. No domain controller required.
Or seed one from a CIS benchmark. Here’s the honest part most teams hit: you don’t have a hardened golden box to capture. So we ship starter templates - CIS Windows L1 (starter), a lower-risk Credential Theft Essentials, and a named ClickFix hardening set - and they’re self-documenting: every control explains why it matters, so you’re not blindly asserting a value you can’t justify in an audit. To make the credential-theft controls actually evaluate (not just sit there grey), the agent collects the credential-theft registry spine - LSA Protection / RunAsPPL, NTLM, WDigest, SMB signing - so those controls light up green or red instead of “unknown.”
A baseline is a document, not a snapshot
This is the part that matters and the part nobody else does. A baseline isn’t a frozen capture you re-take when reality moves. It’s an editable, versioned desired-state document:
- Edit expected values directly - fix a wrong assumption without re-capturing.
- Full version history, with a diff between any two versions, and one-click revert to an earlier one.
- It’s native database versioning - deliberately not Git. (We wrote up why we didn’t reach for Git here: editable, versioned config baselines without Git.)
Diff the fleet, in plain English
Assign a baseline to a device group and RFF diffs every device’s effective policy against it. Drift shows up readable - not a hex blob, the actual setting and its expected-vs-found values - and down to which GPO set each value, read from RSoP. When something’s off because of a Group Policy somewhere, you find out which policy, not just that it’s wrong.
Match modes keep the diff honest to your intent:
- Exact (golden box) - the device must match the baseline exactly. Good when you captured a real reference build.
- Subset (CIS template) - assert these settings, ignore everything else. Good when you’re hardening, not cloning.
Report-only by default. Enforce when you mean it.
Out of the box, Conformance reports. It tells you what drifted and shuts up. When you’re ready to fix drift, turn on enforce - and even then nothing writes blind:
- RFF auto-generates approval-gated remediation jobs for drifted devices. The exact script is staged for a human to read and approve. Nothing touches a box until you click approve.
- Fix one device on demand, too - no need to enforce the whole group.
- Every fix is one-click rollback-able. The inverse script is captured up front, before the change runs, so undo is never “hope you remember what it was."
"Not allowed” assertions
Drift cuts both ways. Sometimes the problem isn’t a missing value - it’s a rogue extra one. Mark a policy value as forbidden and RFF removes it (approval-gated, rollback-able, same as everything else). It’s the surgical cleanup - that specific value, gone - never a blanket purge of everything not in the baseline.
We don’t fight your GPOs
Here’s where a lot of “desired state” tools quietly lie to you. If an active GPO owns a setting, RFF will not try to overwrite it - because Group Policy will just reimpose it on the next refresh and you’d have a box flapping every two hours forever. Instead, Conformance reports the drift and points you at the GPO’s scope so you fix it at the source. We’d rather tell you the truth (“this is GPO-owned, go change the policy”) than start a fight we both lose.
What’s free, what’s paid
Straight, no asterisk games:
- Free, to 100 endpoints - all of it. The read-only effective-policy view, the capture engine, CIS templates, versioned baselines, drift detection across a group, and approval-gated enforce + rollback.
- Past 100 endpoints - the same engine, priced by machine count.
Nothing about Conformance is gated by tier. You pay when you outgrow 100 machines, not to unlock the capability.
This is the feature I most wanted in my hospital years and never got: GPO you can actually read, baseline, version, and diff the fleet against - with a fix that asks permission first and can always be undone. Point it at one well-configured Windows box, capture its effective policy, then point it at a machine you think matches. Watch it tell you exactly what drifted. That five-minute moment is the whole pitch.