Skip to main content

Remote installation and activation of Josys Browser Extension for Google Chrome on Windows using Active Directory (2/2)

Updated

Before you begin

Complete the registry configuration for remote activation before proceeding:

Remote installation and activation of Josys Browser Extension on Windows using Active Directory (1/2)

There are several ways to configure the registry. If you already use a method to force-install another browser extension, we generally recommend using the same method for the Josys Browser Extension.

Installing the agent for a device management tool, such as SKYSEA Client View, may add entries to the registry. Configuring an Administrative Template may overwrite those entries.

Before proceeding, check the existing configuration of the following registry keys:

HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist
HKCU:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist

Select a configuration method based on your environment:

1. Configure a registry item

Step 1: Right-click Group Policy Objects and select New.

Step 2: Enter a name for the GPO and click OK.

Step 3: Right-click the group policy you created and select Edit.

Step 4: In the Group Policy Management Editor, navigate to Computer Configuration > Preferences > Windows Settings > Registry. Right-click Registry and select New > Registry Item.

Step 5: In New Registry Properties, configure the following values, and then click OK:

  • Action: Update
  • Hive: HKEY_LOCAL_MACHINE
  • Key Path: SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
  • Value name: Enter any single-byte number that is not already used by another extension.
  • Value type: REG_SZ

  • Value data:

    moaklgcgokbgplldonjkoochhlefkbjf;https://clients2.google.com/service/update2/crx

Step 6: Link the group policy to the target domain or organizational unit (OU). The target must contain the applicable computer objects.

Right-click the domain or OU to which you want to apply the policy and select Link an Existing GPO.

Step 7: Select the group policy you created and click OK.

 

2. Use an Administrative Template

The following steps deploy the extension through Group Policy Management in Active Directory.

Step 1: Create a new Group Policy Object (GPO). In the left navigation pane, right-click Group Policy Objects, select New, and enter a descriptive policy name such as josysExtInstall.

Step 2: Right-click the new empty policy and select Edit.

Step 3: Navigate to Policies > Administrative Templates Policy Definitions (ADMX files) retrieved from the central store > Google > Google Chrome > Extensions.

Under Settings, open Configure the list of force-installed apps and extensions.

Note: If the Chrome template is unavailable, download the ADMX files from Chrome Enterprise and upload them to the applicable folder.

Step 4: Under Extension/App IDs and update URLs to be silently installed, click Show. Enter the extension ID and update URL joined by a semicolon:

moaklgcgokbgplldonjkoochhlefkbjf;https://clients2.google.com/service/update2/crx

Click OK, select Enabled, and then click Apply.

Step 5: Link the group policy to the target domain or organizational unit (OU). The target must contain the applicable computer objects.

Right-click the domain or OU to which you want to apply the policy and select Link an Existing GPO.

Step 6: Select the group policy you created and click OK.

3. Configure the registry using a script

Step 1: Save the following script as a .ps1 file. If you use Notepad or a similar editor, save the file as UTF-8 with BOM.

This script configures both Google Chrome and Microsoft Edge. Modify it as required for your environment. The script retains the log file at the path specified in the script only when an error occurs.

<#
.SYNOPSIS
    Browser extension force-install configuration script

.DESCRIPTION
    Adds entries to ExtensionInstallForcelist for Google Chrome and Microsoft Edge.
    Supports execution with SYSTEM privileges through SKYSEA, an Active Directory
    startup script, or a similar deployment method.

.NOTES
    Define the browser extensions to be registered in $TargetExtensions
    in the configuration section.
#>

#Requires -Version 5.1
#Requires -RunAsAdministrator

# -----------------------------------------------------------
# Configuration: browser extensions and logging
# -----------------------------------------------------------

# Log file path
$LogFilePath = "C:\Windows\Temp\BrowserExtensionInstall.log"

# Target browsers and extension settings
# Format: "Extension ID;Update URL"
# Modify the IDs and URLs as required.
$TargetExtensions = @(
    @{
        Name    = "Google Chrome"
        RegPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
        # Example: Josys extension ID
        Value   = "moaklgcgokbgplldonjkoochhlefkbjf;https://clients2.google.com/service/update2/crx"
    },
    @{
        Name    = "Microsoft Edge"
        RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"
        # Example: Josys extension ID
        Value   = "hjifncajikcdkhlofdjjlhcjoennmdfc;https://edge.microsoft.com/extensionwebstorebase/v1/crx"
    }
)

# -----------------------------------------------------------
# Initialization
# -----------------------------------------------------------
$script:HasError = $false

try {
    Start-Transcript -Path $LogFilePath -Append -ErrorAction SilentlyContinue
} catch {
    # Continue even if transcript logging cannot be started.
}

Write-Host "--- Process started: $(Get-Date) ---"
Write-Host "Execution user: $env:USERNAME"

# -----------------------------------------------------------
# Function definitions
# -----------------------------------------------------------
function Set-BrowserExtension {
    param (
        [string]$BrowserName,
        [string]$RegistryPath,
        [string]$ExtensionData
    )

    Write-Host "`nChecking the configuration for [$BrowserName]..."

    try {
        # 1. Check and create the registry path.
        if (-not (Test-Path $RegistryPath)) {
            Write-Host "  [INFO] The registry key does not exist and will be created: $RegistryPath"
            New-Item -Path $RegistryPath -Force -ErrorAction Stop | Out-Null
        }

        # 2. Retrieve existing values.
        $existingProps = Get-ItemProperty -Path $RegistryPath -ErrorAction SilentlyContinue
        $numericNames = @()
        $isDuplicate = $false

        if ($existingProps) {
            # Check for duplicates by comparing the value data.
            foreach ($prop in $existingProps.PSObject.Properties) {
                if ($prop.Value -eq $ExtensionData) {
                    $isDuplicate = $true
                    Write-Host "  [SKIP] This extension is already registered (Entry: $($prop.Name))"
                    break
                }
            }

            # Retrieve existing sequence numbers, using numeric value names only.
            $numericNames = $existingProps.PSObject.Properties.Name |
                Where-Object { $_ -match "^\d+$" } |
                ForEach-Object { [int]$_ } |
                Sort-Object
        }

        # 3. Register a new value.
        if (-not $isDuplicate) {
            # Calculate the highest existing value name plus 1.
            $nextNum = 1
            if ($numericNames.Count -gt 0) {
                $nextNum = $numericNames[-1] + 1
            }
            $newValueName = $nextNum.ToString()

            Write-Host "  [ADD] Registering a new entry with the name '$newValueName'"
            New-ItemProperty -Path $RegistryPath -Name $newValueName `
                -Value $ExtensionData -PropertyType String -Force `
                -ErrorAction Stop | Out-Null
            Write-Host "  [SUCCESS] Registration completed"
        }
    } catch {
        Write-Error "  [ERROR] An error occurred while processing ${BrowserName}: $($_.Exception.Message)"
        $script:HasError = $true
    }
}

# -----------------------------------------------------------
# Main process
# -----------------------------------------------------------
foreach ($target in $TargetExtensions) {
    Set-BrowserExtension -BrowserName $target.Name `
        -RegistryPath $target.RegPath `
        -ExtensionData $target.Value
}

Write-Host "`n--- Process completed: $(Get-Date) ---"
Stop-Transcript

# -----------------------------------------------------------
# Completion: determine whether to retain the log and set exit code
# -----------------------------------------------------------
if ($script:HasError) {
    # If an error occurred, retain the log and return exit code 1.
    Write-Warning "An error occurred. Review the log file: $LogFilePath"
    exit 1
} else {
    # If no error occurred, delete the log and return exit code 0.
    Remove-Item -Path $LogFilePath -Force -ErrorAction SilentlyContinue
    exit 0
}

Step 2: Configure Group Policy so that the saved .ps1 file runs as a startup script or through another suitable deployment method.

Related articles