In this article you can find steps to deploy browser extensions via Group Policy (GPO) for Chrome and Edge browsers. It also covers an alternative method of directly modifying the registry using a script deployed via GPO or Microsoft Endpoint Manager (Intune).
Deploy Browser Extensions Using GPO
Step 1: Prepare the Extension
Identify the browser extension you want to deploy.
Locate the extension’s unique identifier (ID):
For Chrome: oacmceopmfdocmdacobjhimnkhaehdfo
For Edge: empfcbaeecolnmpkidjhafmpalccolnl
Note the update URL for the extension:
For Chrome: Use https://clients2.google.com/service/update2/crx.
For Edge: Use https://edge.microsoft.com/extensionwebstorebase/v1/crx.
Step 2: Create a GPO for the Extension Deployment
Open the Group Policy Management Console (GPMC).
Right-click your domain or an Organizational Unit (OU) and select Create a GPO in this domain and link it here.
Name the GPO (for example "Browser Extension Deployment") and click OK.
Step 3: Configure the GPO
Edit the newly created GPO:
Right-click the GPO and select Edit.
Navigate to the following path:
Computer Configuration → Policies > Administrative Templates → Google → Google Chrome → Extensions (for Chrome).
Computer Configuration → Policies → Administrative Templates → Microsoft Edge → Extensions (for Edge).
Enable the Force-Installed Extensions policy:
Double-click Configure the list of force-installed extensions.
Select Enabled.
In the options box, add the extension details in the format:
<extension_id>;<update_url>
Example for Chrome:
oacmceopmfdocmdacobjhimnkhaehdfo;https://clients2.google.com/service/update2/crx
Click Apply and OK to save the changes.
Step 4: Apply the GPO
Close the Group Policy Editor.
Ensure the GPO is linked to the correct domain or OU containing the target computers.
Run the following command on the client machine to force an update if necessary:
gpupdate /force
Verify that the extension is installed in the browser.
Direct Registry Key Update via script
Prerequisites
Script for injecting the extension through Registry key
Chrome
# Define the registry path for current user
$regPath = "HKCU:\Software\Policies\Google\Chrome\ExtensionInstallForcelist"
# Define the extension ID and source URL
$extensionID = "oacmceopmfdocmdacobjhimnkhaehdfo"
# Replace with your extension ID
$updateURL = "https://clients2.google.com/service/update2/crx"
$extensionValue = "$extensionID;$updateURL"
# Ensure the registry path exists
if (-not (Test-Path $regPath)) {
New-Item -Path "HKCU:\Software\Policies\Google\Chrome" -Name "ExtensionInstallForcelist" -Force | Out-Null
}
# Add the extension to the registry
Set-ItemProperty -Path $regPath -Name "1" -Value $extensionValue
# Output confirmation
Write-Host "Chrome extension policy set for current user: $extensionValue"Edge
# Define the registry path for current user
$regPath = "HKCU:\Software\Policies\Microsoft\Edge\ExtensionInstallForcelist"
# Define the extension ID and source URL
$extensionID = "empfcbaeecolnmpkidjhafmpalccolnl"
# Replace with your extension ID
$updateURL = "https://edge.microsoft.com/extensionwebstorebase/v1/crx"
$extensionValue = "$extensionID;$updateURL"
# Ensure the registry path exists
if (-not (Test-Path $regPath)) {
New-Item -Path "HKCU:\Software\Policies\Microsoft\Edge" -Name "ExtensionInstallForcelist" -Force | Out-Null
}
# Add the extension to the registry
Set-ItemProperty -Path $regPath -Name "1" -Value $extensionValue
# Output confirmation
Write-Host "Edge extension policy set for current user: $extensionValue"
Deploy the script using Group Policy as a Logon Script
Copy previously created Script to a Shared Folder:
For Chrome - use the commands above and place the script (HKCUchrome.ps1) in a shared network folder accessible by all users.
For Edge - use the commands above and place the script (HKCUedge.ps1) in a shared network folder accessible by all users.
Create a Group Policy Object (GPO):
Open Group Policy Management Editor.
Create a new GPO named, for example, Deploy_Extension_Install.
Add the Script/Scripts as a Logon Script:
Navigate to User Configuration → Policies → Windows Settings → Scripts (Logon/Logoff).
Double-click Logon.
Click Add and browse to your script path:
Use a UNC path, for example:
\\server\share\HKCUchrome.ps1
or
\\server\share\HKCUedge.ps1
Enforce the Script Execution:
To allow PowerShell scripts, set the execution policy:
In the same GPO, go to: Computer Configuration → Policies → Administrative Templates → Windows Components → Windows PowerShell.
Enable the Turn on Script Execution policy and set it to Allow all scripts.
Link the GPO to the Desired OU:
Link the GPO to the Organizational Unit (OU) containing user accounts or computers.
Additional Notes
Target Environments: Ensure the policies are applied only to the intended user groups or computers.
Supported Browsers: This guide focuses on Chrome and Edge but can be adapted for other browsers with similar administrative templates.
Tools for Deployment:
Use GPO for on-premise environments.
Use Intune for cloud-based deployment.