Bake in the enrolment token, and install Chrome when missing

Setup asked for a token that is the same on every machine - a token is reusable
and enrols any number of browsers - so it is a default in both scripts now and
step 7 is a plain yes/no. It is a modest secret: it lets someone enrol their own
browser into the org and nothing more, and rotating it is a console click and a
one-line change.

Both scripts also install Chrome if it is absent, from Google's enterprise MSI
and the official .deb, since enrolling a browser that is not there writes a
token nothing reads. Chromium is refused rather than substituted: no cloud
management, so it could never be enrolled - and on ARM, where Chrome is not
published at all, the Linux script says so instead of installing something that
cannot do the job.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/enroll-chrome-management.ps1

@@ -21,8 +21,14 @@
 #>
 [CmdletBinding()]
 param(
-    [Parameter(Mandatory = $true, ParameterSetName = 'Enrol')]
-    [string]$Token,
+    # Defaulted so setup is hands-off. An enrolment token is reusable and enrols
+    # any number of browsers, which is what makes a baked-in default work at all.
+    # It is a modest secret: anyone holding it can enrol *their* browser into the
+    # org, which gets them our policies and a row in the console — it grants no
+    # access to the Google account or to anything else. Rotate it in Devices >
+    # Chrome > Managed browsers and change it here.
+    [Parameter(ParameterSetName = 'Enrol')]
+    [string]$Token = 'ce4fa6cd-e940-45f6-9086-85075d6cff34',
 
     # Refuse to start Chrome at all if enrolment fails. Sound on a fleet, risky
     # on a trading PC: a revoked token would leave you with no browser.
@@ -34,7 +40,10 @@ param(
 
     # Fail instead of asking for elevation. Also the loop-breaker: the elevated
     # copy is launched with this set, so it can never spawn another.
-    [switch]$NoElevate
+    [switch]$NoElevate,
+
+    # Fail rather than installing Chrome when it is missing.
+    [switch]$SkipChromeInstall
 )
 
 $ErrorActionPreference = 'Stop'
@@ -52,6 +61,7 @@ if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
     # arguments are already parsed and can be passed on intact.
     Write-Host 'Asking for administrator rights — the enrolment token is machine-level.'
     $psArgs = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$PSCommandPath`"", '-NoElevate')
+    if ($SkipChromeInstall) { $psArgs += '-SkipChromeInstall' }
     if ($Remove) { $psArgs += '-Remove' }
     else {
         $psArgs += @('-Token', $Token)
@@ -63,6 +73,38 @@ if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
     exit $elevated.ExitCode
 }
 
+# ── Chrome itself ────────────────────────────────────────────────────────────
+# Enrolling a browser that is not installed would write a token nothing ever
+# reads. Chromium is deliberately not accepted as a substitute: it has no
+# cloud-management support, so it can never be enrolled and would stay subject
+# to the off-store restriction forever.
+function Find-Chrome {
+    foreach ($exe in @("$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
+                       "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
+                       "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe")) {
+        if ($exe -and (Test-Path $exe)) { return $exe }
+    }
+    return $null
+}
+
+if (-not $Remove -and -not (Find-Chrome)) {
+    if ($SkipChromeInstall) { throw 'Google Chrome is not installed, and -SkipChromeInstall was given.' }
+
+    # Google's own enterprise MSI, which installs machine-wide and silently. We
+    # are already elevated by this point, so this needs no second prompt.
+    $msi = Join-Path $env:TEMP 'googlechromestandaloneenterprise64.msi'
+    Write-Host 'Google Chrome is not installed — downloading it from Google (about 120 MB).'
+    Invoke-WebRequest -Uri 'https://dl.google.com/dl/chrome/install/googlechromestandaloneenterprise64.msi' `
+                      -OutFile $msi -UseBasicParsing
+
+    Write-Host 'Installing Chrome...'
+    $msiexec = Start-Process msiexec.exe -Wait -PassThru -ArgumentList @('/i', "`"$msi`"", '/qn', '/norestart')
+    Remove-Item $msi -ErrorAction SilentlyContinue
+    if ($msiexec.ExitCode -ne 0) { throw "Chrome install failed (msiexec exit $($msiexec.ExitCode))." }
+    if (-not (Find-Chrome)) { throw 'Chrome still not found after installing.' }
+    Write-Host 'Chrome installed.'
+}
+
 $key = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
 if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }