senofy/autofirmer-expanded
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bake in the enrolment token, and install Chrome when missing

Browse Source 
Setup asked for a token that is the same on every machine - a token is reusable
and enrols any number of browsers - so it is a default in both scripts now and
step 7 is a plain yes/no. It is a modest secret: it lets someone enrol their own
browser into the org and nothing more, and rotating it is a console click and a
one-line change.

Both scripts also install Chrome if it is absent, from Google's enterprise MSI
and the official .deb, since enrolling a browser that is not there writes a
token nothing reads. Chromium is refused rather than substituted: no cloud
management, so it could never be enrolled - and on ARM, where Chrome is not
published at all, the Linux script says so instead of installing something that
cannot do the job.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon Li
2026-08-31 16:18:20 -05:00
co-authored by Claude Opus 5
parent 35dd15d584
commit 389c714caf
5 changed files with 104 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup-windows.bat
+11 -11
View File
@@ -335,14 +335,14 @@ echo.
echo [7/7] Chrome extension
echo Enrols this machine's Chrome, after which the extension installs
echo itself from the Admin console and stays updated on its own.
echo The token is in the Admin console under
echo Devices ^> Chrome ^> Managed browsers. Blank to skip.
set "ENROLTOKEN="
set /p "ENROLTOKEN= Enrollment token: "
if not defined ENROLTOKEN goto :ext_skipped
REM The token is machine-scoped, so this raises a UAC prompt and only this. The
REM script asks for elevation itself; nothing else in this installer needs it.
powershell -NoProfile -ExecutionPolicy Bypass -File "%TARGET%\scripts\enroll-chrome-management.ps1" -Token "%ENROLTOKEN%"
echo Installs Chrome first if it is not here yet.
set "DOEXT="
set /p "DOEXT= Set this up now? [Y/n] "
if /i "%DOEXT%"=="n" goto :ext_skipped
REM The enrolment token is built into the script, so there is nothing to type.
REM It is machine-scoped, so this raises a UAC prompt - the only one in this
REM installer, and the script asks for it itself.
powershell -NoProfile -ExecutionPolicy Bypass -File "%TARGET%\scripts\enroll-chrome-management.ps1"
if errorlevel 1 (
echo [!] Enrolment failed. Re-run scripts\enroll-chrome-management.ps1 with
echo a fresh token from the Admin console to try again.
@@ -353,8 +353,8 @@ if errorlevel 1 (
goto :ext_done
:ext_skipped
echo Skipped. Run scripts\enroll-chrome-management.ps1 -Token ^<token^>
echo later; until then this machine gets no extension.
echo Skipped. Run scripts\enroll-chrome-management.ps1 later;
echo until then this machine gets no extension.
set "EXTPOLICY=0"
:ext_done
@@ -400,7 +400,7 @@ if "%EXTPOLICY%"=="1" (
echo and the extension installs itself within a minute or two.
) else (
echo - Enrol Chrome so it can install the extension:
echo scripts\enroll-chrome-management.ps1 -Token ^<token^>
echo scripts\enroll-chrome-management.ps1
)
echo - Add your firm credentials on the dashboard's Settings page
echo.