senofy/autofirmer-expanded
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enrol Chrome from the installers, and drop load-unpacked

Browse Source 
Both setup scripts ended by telling you to load the folder unpacked, which is
the one install that cannot update itself - and the policy install they moved
to next does nothing on an unmanaged machine. Enrolment is the step that
actually matters: with it, the extension arrives from the Admin console already
force-installed, and there is nothing else to configure on the box.

So step 7 now asks for an enrolment token instead. The Windows script elevates
itself for it - the token is machine-scoped, and that is the only UAC prompt in
the whole install.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon Li
2026-08-31 16:14:14 -05:00
co-authored by Claude Opus 5
parent 95c073d4c2
commit 35dd15d584
4 changed files with 82 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+15 -16
View File
@@ -126,30 +126,29 @@ Automations are declared in `lib/automations.ts` — one entry per firm, with th
steps inside. Adding a button means editing that file; the page and the runner
pick it up from the server.
### 1. Load the extension
### 1. Install the extension
`chrome://extensions` → enable **Developer mode** → **Load unpacked** →
select the `extension` folder.
That is the development install. On a machine that just runs trades, install it
from our own update server instead, and Chrome keeps it updated by itself — the
setup scripts offer this as their last step, and it can be run on its own at any
time:
The setup scripts do this as their last step: give them the Chrome Enterprise
Core enrolment token from the Admin console (Devices → Chrome → Managed
browsers) and they enrol this machine's Chrome. The extension then arrives from
the console already set to force install, and Chrome keeps it updated. Run on
its own at any time:
```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-management.ps1 -Token <token>
```
```bash
sudo scripts/install-extension-policy.sh
sudo scripts/enroll-chrome-management.sh <token>
```
**This only works on an enterprise-managed machine** — domain-joined,
Entra-joined, or enrolled in Chrome Enterprise Core. No Chromium browser will
force-install an off-store extension on an ordinary PC, whatever the registry
says; the scripts check and refuse rather than leave a dead policy behind. On an
unmanaged box, load `extension/` unpacked and let it reload itself. See
[deploy/README.md](deploy/README.md). Either way the extension notices when
**Enrolment is not optional.** No Chromium browser will force-install an
off-store extension on an unmanaged machine, whatever the registry says — it
reads the policy and blanks it. Enrolling is what makes Chrome managed without
joining a domain; Edge cannot be used this way at all. `install-extension-policy`
is still there for a genuinely domain-joined machine, where local policy is
honoured. See [deploy/README.md](deploy/README.md). Either way the extension
notices when
the dashboard is running newer code than it is: a policy install asks Chrome to
fetch the new CRX, an unpacked one reloads itself from disk. Clicking the reload
icon on its card still works and is the thing to try when something looks