For IT providers who manage many clients

Group Policy.
Without the server.

Your clients' PCs left the domain. Their Group Policy doesn't have to. Pick settings in a web console laid out like the Group Policy editor, and our software on each PC applies them as real local policy.

Entra-joined or workgroup PCs. No domain controller, no VPN, no line of sight to a server.

Clients › Example Dental › Main office › FRONTDESK-02 · What's in effect

Turn off the camera on the lock screenEnabledFrom "Office baseline" · linked to Example Dental

Configure Automatic UpdatesEnabledFrom "Patch window" · linked to Main office · Locked

Allow search box suggestionsDisabledFrom "Front desk" · linked to this PC

What it does

The Group Policy you know, delivered from the web.

Nothing new to learn. The same settings tree, the same three states, the same linking rules. Only the domain controller is gone.

Every Administrative Template

All 3,621 Windows 11 settings, in the same Computer and User Configuration tree as the Group Policy editor, with Microsoft's help text. Search finds any of them by name. Add your own templates for Edge, Chrome, Office or the line-of-business app that still needs its registry keys.

Linked like a GPO

Build a policy, then link it to a client, a branch or a single PC. Link order, Locked (Enforced) and Don't inherit (Block inheritance) work the way they do in Active Directory.

What's in effect, per PC

Your gpresult in the browser: every setting a PC has, its value, and exactly which policy and which level it came from.

Real local policy

Settings go into Windows' own local Group Policy store. Windows treats them as policy, applies them itself, and shows them in gpresult like any other.

One console, every client

All your clients, branches and PCs in one place, each kept separate. No signing in and out of a tenant per client.

Everything logged

Who changed what and when, and what each PC applied. When something goes wrong, the answer is one page away.

Why Group Policy

Cloud management is fine. Group Policy is better at this.

Moving PCs off the domain usually means giving up the tool that worked. GPOSugar keeps the parts IT people actually miss.

Minutes, not hours

GPOSugarPCs check in every 10 minutes. Press Check in now and the PC picks it up within seconds and runs gpupdate /force for you.

Typical cloud MDMDevices sync on the service's schedule, which can take hours. Painful in the middle of troubleshooting.

Every setting, not a subset

GPOSugarThousands of Administrative Template settings, plus any ADMX you upload. Older apps that read their own policy keys just work.

Typical cloud MDMA settings catalog that's growing but still narrower, and older apps often need custom work.

Inheritance you can read

GPOSugarClient, branch, PC. Link order, Locked and Don't inherit. Each PC's result is worked out once and shown with where it came from.

Typical cloud MDMDynamic groups calculated in the background. Conflicts can be silent, and changes can lag.

Enforced, and no tattooing

GPOSugarIf someone changes a setting, it goes back. Remove a policy and its settings come off. Uninstall and the PC's own local policy is exactly as it was.

Typical cloud MDMSettings can stay behind after a profile is removed, and cleaning up means scripts.

How it works

Four steps, no server to build.

Install the softwareOne MSI, pushed with your RMM or installed by hand. Each PC enrolls itself to the right client.
Build your policiesSearch or browse the settings tree, set Enabled or Disabled and the options, and save it as a policy.
Link and previewLink the policy to a client, branch or PC. New clients start in dry run: every PC reports what it would set, and sets nothing.
Go liveTurn off dry run and each PC applies its policy at its next check-in, or right away with Check in now.

Safety

Careful with your clients' PCs.

There's no domain controller to fix a mistake from, so the safeguards are built in.

Dry run first. A new client changes nothing until you say so, and switching back to dry run takes every GPOSugar setting off again.
Only its own settings. GPOSugar keeps track of exactly what it wrote. Local policy someone set by hand on a PC is left alone.
A clean way out. Removing a policy, or uninstalling, puts the PC's local policy back the way it was.
It can't lock itself out. Policy can never switch off or block GPOSugar's own software.
Plays well with others. Runs beside Super Print's software on the same PC. Domain-joined PCs keep their domain policy, which always wins.

Coming next

Bring all of your Group Policy.

In the works

Import a GPO backup

Retiring a client's server? Upload its GPO backup and get the same policies in GPOSugar, with a list of anything that couldn't come across.

Planned

Security and audit policy

Password and lockout rules, user rights and audit settings, with extra safeguards against locking anyone out.