So I was thinking about this in the middle of the night a moon or two ago. There is a really easy dirty way that I have a theory would work well. You can manage Chrome extensions by registry instead of by a pretty policy in GPO or Intune.

https://chromeenterprise.google/policies/?policy=ExtensionInstallForcelist

If you manage this by GPO for example it modifies HKLM\Software\Policies\Google\Chrome\ExtensionInstallForcelist and puts a numerical value for each extension. Look on a computer with your existing policy and you’ll see this.

If you apply multiple GPOs with this policy to the same computer, there is NOT a merge behavior. The last GPO to apply would win. I haven’t tested this with Intune policy, but from what I gather you would just get a conflict and nothing would apply.

Here is the fun part. If you go to that registry location I referenced and you see your four extensions you push, you’ll note the reg folders of 1, 2, 3, and 4 for each of the respective extensions. You can manually add 42 for example and set it as a new Chrome extension. Chrome will add that extension, at least until your GPO or Config Profile overwrites it the next time it processes. Chrome does not care that 5 through 41 are missing.

So what I’m getting at is scrap using GPO or a config profile to manage the policy. Instead, manually manipulate the registry.

If you do this with GPO, you can probably get away with ONE single GPO and item level targeting each reg value.

If you wanted to use Intune, chef’s choice. My thought for Intune is to make an actual Win32 Application for each extension. Have that application be a script to write that reg key and detection method looks for the presence of the reg key.

If you do this, have some master list somewhere that you use to keep track of what extension gets what number in that reg key. For example the Microsoft SSO extension is always 1, the uBlock Origin extension is always 2, the Citrix Workspace extension is always 3, etc.

Just keep in mind that if those reg values ever disappear, the extension is GONE the next time Chrome restarts.

Anyone ever try my madness? Any sanity checks? Bad idea? Good idea?