Install chrome extensions via GPO

google-chromegroup-policywindows-server-2008

I'm attepting to install the adblock chrome extension using Google's Chrome ADM's.

User Configuration/Policies/Classic Administrative Templates/Google/Google Chrome/Extensions

Configure the list of force-installed extensions

On the list I have the extension's ID and update URL, which google alludes to in their documentation here and here:

gighmmpiobklfepjocnamgkkbiglidom;https://clients2.googleusercontent.com/crx/download/OAAAAMcNmg40_PduZlM3g5RwKyephtivPe8WdfQvWSRvhiHzrcK7rq-gXuF37bTwLfLPyVSTPaQkAXkHIklkQOFOqzUAxlKa5asxHnxnSbCB7xq3hVhoYHdhKQHD/extension_2_5_38.crx

I managed to get the update URL using the instructions in this question, but so far, I have been unsuccessful in that the extension is not actually getting installed.

Is there something I'm missing or doing incorrectly?

Best Answer

Apparently, the "Configure the list of force-installed extensions" ADM policy simply does not work at all.

So, I ended up having to use the registry method.

NOTE: If using the registry method, the extension is automatically disabled in version 25 of Chrome. Also note that for Chrome 25 and up, the ADM policy now works.

Find the extension ID of your desired extension. This is the unique ID of the extension in the Chrome webstore. You can see this ID in the URL of the extension ie:

https://chrome.google.com/webstore/detail/gighmmpiobklfepjocnamgkkbiglidom

or, Open the extensions list in Chrome; tick the Developer Mode tick box and then click the arrow next to the extension you want to deploy - the extension ID will be underneath the extension's heading.

At this point, it is worth making note of the extension's version number too, as you will need this later on in the deployment.

Open a browser other than chrome - Firefox will work fine. Paste the following line into the address bar, replacing the ----- with the extension ID

https://clients2.google.com/service/update2/crx?response=redirect&x=id%3D-----%26uc Press enter to access this URL; you will be prompted to save the .crx file.

Copy this .crx file to your deployment shared folder eg \Server\SoftwareDeployment\ChromeExtensions\.crx

Source: http://bdts.com.au/tips/48-msi-packaging/156-deploy-google-chrome.html

Next, add the registry keys in computer configuration\preferences\windows settings\registry:

Create the following registry key values:

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\[id of your extension crx]\path
TYPE: REG_SZ
VALUE: "\\server\NETLOGON\path\to\your\extension.crx"
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\[id of your extension crx]\version
TYPE: REG_SZ
VALUE: [version of your .crx as specified in the manifest]

Source: http://support.google.com/a/bin/answer.py?hl=en&answer=188453

Related Solutions

google-chrome – Where to Find the Update URL for Google Chrome Extensions

I can't help you with group-policy, but each extension includes its update URL in manifest.json.

So, for the current version of adblock (id: gighmmpiobklfepjocnamgkkbiglidom):

%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.14_0\manifest.json

Contains:

"update_url": "http://clients2.google.com/service/update2/crx"

The extension will query that URL for updates, as per the documentation.

We can therefore construct a URL that will return the update XML from the above URL (just change the ID as needed) - for adblock:

http://clients2.google.com/service/update2/crx?response=updatecheck&x=id%3Dgighmmpiobklfepjocnamgkkbiglidom%26uc

The XML that is returned reads:

<?xml version="1.0" encoding="UTF-8"?>
<gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod">
    <daystart elapsed_seconds="49387"/>
    <app appid="gighmmpiobklfepjocnamgkkbiglidom" status="ok">
        <updatecheck codebase="http://clients2.googleusercontent.com/crx/download/OAAAAFpzXu4buuGNADfzIKiz34SLARZdBLiXQ2zo50sAlzoBpEz77foH-XT3yHpPureXtHcQSYU2z4ZNstiuKJi-LD8AxlKa5VgufvySdIb5b9U333P0upRk1YPb/extension_2_5_14.crx" hash="" size="529317" status="ok" version="2.5.14"/>
    </app>
</gupdate>

We are interested in the codebase attribute of updatecheck, which provides us the direct URL to the latest CRX file.

How to deny Google Chrome extensions access to intranet content

All the settings currently available to you via Group Policy are listed on the Chromium site. You can block all extensions, then allow certain ones via a whitelist, but I don't see anything in there that does specifically what you want.

In terms of blocking access to extensions, they will have access to whatever the user running Chrome has access to. Since the extension can access the content after it has been downloaded by the browser, there is no way the server can control this access.

So your choices seem to be maintaining an approved list of extensions you aren't worried about, or making a custom version of Chrome (Chromium is Open Source) to distribute to users that includes the functionality you are looking for.

Reading the Chrome Extensions Developer Guide section on Content Scripts, particularly the sections on Execution Environment, Communication with the Embedding Page and Security Considerations, will give you a better understanding of how Chrome Extensions work, and may suggest where you have opportunities either working with Chromium, or customising extensions.

Or set up some sophisticated deep packet inspection firewall that can identify content you don't want to leak, which would have the additional benefit of covering all applications - but be rather expensive :-)

Best Answer

Related Solutions

google-chrome – Where to Find the Update URL for Google Chrome Extensions

How to deny Google Chrome extensions access to intranet content

Related Topic