From 56114b727c0f7731a524f448d0b14dd32f53e4d2 Mon Sep 17 00:00:00 2001 From: Brandon Li Date: Mon, 31 Aug 2026 15:55:27 -0500 Subject: [PATCH] dsregcmd cannot see Chrome Enterprise Core The managed check asked Windows, but Enterprise Core is browser management by Google: Windows reports a plain standalone machine however enrolled Chrome is. The guard therefore blocked the exact path it recommends. It now asks Chrome first - the dmtoken it writes on a successful enrolment, and the enrolment token that requests one, in both registry views - and only then falls back to domain and Entra join state. Co-Authored-By: Claude Opus 5 --- scripts/install-extension-policy.ps1 | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/scripts/install-extension-policy.ps1 b/scripts/install-extension-policy.ps1 index bcc145a..4aab755 100644 --- a/scripts/install-extension-policy.ps1 +++ b/scripts/install-extension-policy.ps1 @@ -111,6 +111,25 @@ function Test-BrowserInstalled([string]$Name) { nothing, this refuses up front and says what the ways round it are. #> function Test-DeviceManaged { + # Chrome Enterprise Core has to be checked first and separately. It is + # *browser* management, by Google — Windows has no idea it happened, so + # dsregcmd reports an ordinary standalone machine no matter how enrolled + # Chrome is. Ask Chrome instead: `dmtoken` is what it writes once an + # enrolment succeeds, and the enrolment token is the request for one. Both + # views of the registry, because a 32-bit Chrome writes under WOW6432Node. + $probes = @( + @{ Key = 'HKLM:\SOFTWARE\Google\Chrome\Enrollment'; Name = 'dmtoken' }, + @{ Key = 'HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\Enrollment'; Name = 'dmtoken' }, + @{ Key = 'HKLM:\SOFTWARE\Policies\Google\Chrome'; Name = 'CloudManagementEnrollmentToken' } + ) + foreach ($probe in $probes) { + $item = Get-ItemProperty -Path $probe.Key -ErrorAction SilentlyContinue + if ($item -and ($item.PSObject.Properties.Name -contains $probe.Name) -and $item.($probe.Name)) { + return $true + } + } + + # Then the Windows side, which covers domain and Entra joins. try { $status = & dsregcmd /status 2>$null | Out-String return ($status -match 'AzureAdJoined\s*:\s*YES') -or @@ -143,11 +162,15 @@ if (-not $targets) { if (-not $Remove -and -not $Force -and -not (Test-DeviceManaged)) { Write-Warning @' -This machine is not enterprise managed - not domain-joined, not Entra-joined, -not enrolled in Chrome Enterprise Core - and no Chromium browser will +This machine does not look enterprise managed - no Chrome Enterprise Core +enrolment token, no domain join, no Entra join - and no Chromium browser will force-install an extension from outside its own web store on such a machine. The policy would be read and blanked. Nothing was written. +If chrome://management already names your organisation, this check is simply +wrong: run enroll-chrome-management.ps1 so the token is on this machine, or +re-run with -Force. + Three ways forward: 1. Load extension\ unpacked. It has no update channel, but it reloads itself