SafeToOpen Browser Security

Windows: Group Policy and registry

On-premises Active Directory, RMM tools and hand-built images

Guide 3 of 11 · April 2026

Use this guide when devices are not in Intune: classic domain-joined PCs managed by Group Policy, fleets managed by an RMM tool that can run scripts or import registry files, or golden images. The mechanism is identical to guide 2, only the delivery differs: everything is a registry value under HKLM\SOFTWARE\Policies.

1. Force-install with Group Policy#

Copy the Edge ADMX (from the Edge for Business download page) and Chrome ADMX (Chrome Enterprise bundle) into your central store \\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions.
Create a GPO linked to the computer OUs. Computer Configuration → Policies → Administrative Templates.
Microsoft Edge → Extensions → “Control which extensions are installed silently”: Enabled, value bbgoikmidjfiaaadlgkpdlppilhkjfke;https://edge.microsoft.com/extensionwebstorebase/v1/crx.
Google → Google Chrome → Extensions → “Configure the list of force-installed apps and extensions”: Enabled, value ekfkopmgnijagfmjgcjkbffcnmggekec;https://clients2.google.com/service/update2/crx.

2. Push the enrolment values#

Neither ADMX exposes a third-party extension policy, so the four values go in as registry values. Three ways, pick one:

2a. Group Policy Preferences (per-device values with variables)#

In the same GPO: Computer Configuration → Preferences → Windows Settings → Registry → New → Registry Item, action Update, hive HKEY_LOCAL_MACHINE.
Key path SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\bbgoikmidjfiaaadlgkpdlppilhkjfke\policy. Create four REG_SZ items: enrol_key = your key, user_name = %LogonUser% is not available at computer scope, so use %LogonDomain%\%LogonUser% in a User Configuration preference instead (see note), asset_name = %ComputerName%, domain_name = workspace or blank.
Repeat for SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\ekfkopmgnijagfmjgcjkbffcnmggekec\policy.

Note Preference variables that name the user only resolve in User Configuration, while the policy key lives in HKLM. Simplest reliable combination: put enrol_key, asset_name and domain_name in a Computer preference, and user_name = %LogonDomain%\%LogonUser% in a User Configuration registry preference targeting the same HKLM key (Group Policy Preferences write to HKLM from user scope because the client-side extension runs as SYSTEM). The backend turns DOMAIN\login into an email with the domain configured in Settings → Unattended enrolment.

2b. Logon or startup script#

Run the PowerShell script from guide 2, section 3, as a computer startup script (it runs as SYSTEM). Replace the Intune-specific UPN lookup with the domain UPN of the logged-on user if your RMM runs in user context, or keep the Win32_ComputerSystem.UserName fallback and set the email domain in the console.

2c. A .reg file (RMM import, images, manual)#

The console generates this file with your key filled in (Settings → Unattended enrolment → “.reg file”). Replace the user and device values per machine, or let your RMM substitute them:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist]
"1"="bbgoikmidjfiaaadlgkpdlppilhkjfke;https://edge.microsoft.com/extensionwebstorebase/v1/crx"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\bbgoikmidjfiaaadlgkpdlppilhkjfke\policy]
"enrol_key"="PASTE-ENROLMENT-KEY"
"user_name"="[email protected]"
"asset_name"="LAPTOP-0421"
"domain_name"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"1"="ekfkopmgnijagfmjgcjkbffcnmggekec;https://clients2.google.com/service/update2/crx"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\ekfkopmgnijagfmjgcjkbffcnmggekec\policy]
"enrol_key"="PASTE-ENROLMENT-KEY"
"user_name"="[email protected]"
"asset_name"="LAPTOP-0421"
"domain_name"=""

Important Never bake a real user_name into a golden image. Leave it blank in the image and let a startup script or preference fill it; the extension waits until both user_name and asset_name are present.

3. Verify#

Run gpupdate /force on a test PC and start the browser.
edge://policy or chrome://policy → Reload policies. The force-list shows the ID and the extension ID section shows the four values.
The console’s Enrolled devices list shows the PC within a minute.

4. Removing#

Delete the 3rdparty\extensions\<id> key and the force-list entry, or unlink the GPO. The extension is removed at the next policy refresh. Removing the person on the People page revokes access at once even if the policy lingers, but they re-enrol at the next browser start until the policy is gone.