Manage the lifecycle of your Group Policy Objects

Universal Policy Administrator is web-based Group Policy management software for the enterprise. It provides a browser console for authoring, reviewing, approving and deploying Group Policy Objects across multiple domains and forests, with version history, rollback, role-based delegation and full audit trails.

Neither. UPA is on-premise software, installed on your own servers and reached through a browser across your own network. Policy data stays inside your environment and no internet connection is required, so it suits isolated, air-gapped and regulated environments as well as connected ones.

Not for the change control itself. The difference is architectural: a browser console rather than a client installed on domain-joined desktops. That is what allows it to reach untrusted and acquired domains, be used from any workstation, upgrade in one place, and expose every managed domain to PowerShell.

UPA is a direct successor to Advanced Group Policy Management. It provides the same controlled change process — a managed archive, editor and approver roles, check-out and check-in, version history and rollback — without the MDOP licensing AGPM required, and adds multi-domain management and a web console.

Yes, and identically. UPA authenticates to each domain in its own right rather than relying on a trust chain, so an untrusted domain is imported once and then managed exactly like a trusted one — the same live connection, editor, approval workflow and version history, from the same console.

No. UPA writes standard Group Policy Objects into Active Directory, which Windows processes exactly as it always has. There is no client agent, no schema extension and no parallel enforcement channel — policies deployed by UPA keep working whether or not UPA is still in place.

Yes. Every version of every policy is retained, so recovery is a matter of selecting an earlier version and redeploying it. There is no dependency on a backup having been taken before the change, because the history is created by the change process itself.

Yes — any two points in a policy’s life, read as a list of settings added, removed or changed. Version against version, against the last approved version, against the live GPO in Active Directory, or one policy against another. Administrative templates, security settings and Group Policy Preferences all compare, and the same comparison is available from PowerShell as well as the console.

Precedence depends on link order, inheritance and blocking, and is not visible from any single screen in native tooling. UPA reports the effective result for a target, and flags settings that two policies both define, so a conflict is something you are shown rather than something you work out.

Yes. Every version is retained with its author, timestamp and check-in comment, so the state of a policy at any point in the period is read from the history rather than reconstructed from backups. Native Group Policy keeps none of this: editing a GPO discards what was there before.

No. The GPO in SYSVOL is the live object, so every save takes effect at the next refresh whether or not you had finished — which is why so much Group Policy work is done out of hours. In UPA the policy is authored, compared and approved in its own store, and nothing reaches Active Directory until someone deploys it.

Each version records its author, timestamp and the comment they left, along with who approved it and when it was deployed. Activity across the Repository — deployments, approvals, permission changes and exports — is recorded, so questions about who changed or copied a policy are answered from the record.

Yes. Roles in UPA are scoped to the policies and the part of the Repository a team owns, so an administrator can be given authority over their own policies without directory-level rights over every other GPO in the domain.

Yes — security settings, Group Policy Preferences, WMI filters and security filtering, alongside administrative templates in both ADMX and legacy ADM format, read from your own Central Store. That includes custom and third-party templates such as Citrix, Adobe and Chrome. Editing, version comparison and deployment cover the whole Group Policy Object rather than the registry-backed portion of it.

Not to use the console. Administration happens in a browser, so an administrator does not need the Group Policy Management Console installed, nor a domain-joined Windows desktop, to author and submit policy changes.