Group Policy without a domain controller
A lot of real Windows shops have no DC. A workgroup that never grew into a domain. An office that went all-in on Google Workspace. A business that was “going to do Intune next year” several years ago. They still have the same problem a domain shop has: settings that must be enforced on every machine, and no way to do it that isn’t touching each box by hand.
The tools Microsoft gives you both assume infrastructure. gpedit.msc is genuinely good and it’s on every machine - but it’s per-machine, so enforcing one setting across ten boxes is ten remote sessions and a spreadsheet that’s wrong by March. Intune wants Entra join and per-user licensing before it does anything at all.
RFF’s Settings Catalog is the gpedit experience across a fleet, with none of the infrastructure. The full Administrative Template catalog, searchable, enforced through the same baseline engine that handles drift and conformance - over an agent that only ever talks outbound HTTPS.
Start free → · 100 endpoints free · No DC, no Entra, no sales call
How it works
1. Get your catalog - from a machine you already have. Pick any device and RFF collects its Group Policy templates in one click (on a domain it prefers the DC’s central store, which also carries any custom ADMX you’ve added). Or upload a PolicyDefinitions folder as a zip. A stock Windows 11 folder parses into 4,641 real settings - the same catalog gpedit shows, with Microsoft’s own display names and explanations.
2. Find the setting in plain English. Search “recently opened documents” or “automatic updates” instead of guessing registry paths. Every setting shows the vendor’s actual explanation text, its category path, and - before you commit to anything - the exact registry values it writes.
3. Pick a state, like gpedit. Enabled, Disabled, or Not configured - with dropdowns and fields built from the ADMX itself, so a policy with options renders its real options. Not configured does what it should: it removes the values from managed machines, rather than leaving them tattooed behind.
4. Enforce it like desired state. Add settings to a Conformance baseline, assign it to a device group, and RFF reports every machine that drifts. Turn on enforce and fixes are approval-gated - the exact script is staged for a human to read first - and one-click rollback-able, with the inverse captured before anything runs.
Machine and user settings, both
Computer Configuration settings land in the machine hive. User Configuration settings land in the signed-in user’s own hive, applied the same way the Group Policy engine itself applies per-user policy - not a fragile run-as trick. A user-scope setting waits for that user’s next sign-in if they’re away, then applies.
Bring any vendor’s ADMX
Chrome, Edge, Zoom, Firefox, or a template you wrote yourself. RFF acts as your central store: upload the vendor’s ADMX once and deploy its settings fleet-wide - endpoints don’t need the template installed to receive the setting, because what ships is the registry state the template defines, not the template.
Already have a domain? It plays nice.
Settings Catalog isn’t only for the DC-less. Two honest behaviors matter here:
- Collection prefers your central store. Collecting templates from a DC picks up the authoritative set, custom ADMX included.
- RFF refuses to fight your GPOs. If an active GPO owns a value, RFF won’t overwrite it - Group Policy would just reimpose it on the next refresh and the box would flap forever. Instead it names the owning GPO and points you at the source. Useful for MSPs co-managing clients where some sites have a DC and some never will.
The usual answers, honestly
- gpedit on each box works and costs nothing - and doesn’t scale past a handful of machines, has no record of what you set, and can’t tell you when something changes.
- Intune is the right answer if you’re already Entra-joined and licensed. If you’re not, it’s an identity migration project before it’s a settings tool.
- Registry scripts (deploy a .reg, GPP-style hacks) are write-only: they set the value once and go blind. No catalog, no explanations, no drift detection, no rollback.
RFF sits in the gap: catalog-driven like gpedit, fleet-wide like Intune, no domain or licensing prerequisites like a script - plus drift detection and rollback none of them give you.
FAQ
Do I need a domain controller, Active Directory, or Entra? No. The agent enrolls with one PowerShell line on any Windows machine and talks outbound HTTPS (443) only.
Where do the settings actually go? The same registry-backed policy state Group Policy writes, previewed in the UI before you deploy. Machine policy to the machine hive, user policy to the signed-in user’s hive.
Do endpoints need the vendor’s ADMX installed? No. Templates live in RFF; endpoints receive the resulting policy values.
Will it conflict with my existing GPOs? No - GPO-owned values are reported with the owning GPO named, never overwritten. Fix those at the source; RFF handles everything a GPO doesn’t own.
What does it cost? It’s included on every plan, free tier included - free for your first 100 endpoints, no credit card. You pay for machine count past 100, not to unlock the feature.
How is this different from Conformance? Same engine. The Settings Catalog is how you author desired state from ADMX; Conformance is how it’s diffed, enforced, and rolled back. The build story is on the blog, including the parser bug that made every Chrome list policy silently do nothing.