dsregcmd cannot see Chrome Enterprise Core

The managed check asked Windows, but Enterprise Core is browser management by
Google: Windows reports a plain standalone machine however enrolled Chrome is.
The guard therefore blocked the exact path it recommends. It now asks Chrome
first - the dmtoken it writes on a successful enrolment, and the enrolment
token that requests one, in both registry views - and only then falls back to
domain and Entra join state.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/install-extension-policy.ps1

@@ -111,6 +111,25 @@ function Test-BrowserInstalled([string]$Name) {
     nothing, this refuses up front and says what the ways round it are.
 #>
 function Test-DeviceManaged {
+    # Chrome Enterprise Core has to be checked first and separately. It is
+    # *browser* management, by Google — Windows has no idea it happened, so
+    # dsregcmd reports an ordinary standalone machine no matter how enrolled
+    # Chrome is. Ask Chrome instead: `dmtoken` is what it writes once an
+    # enrolment succeeds, and the enrolment token is the request for one. Both
+    # views of the registry, because a 32-bit Chrome writes under WOW6432Node.
+    $probes = @(
+        @{ Key = 'HKLM:\SOFTWARE\Google\Chrome\Enrollment';                    Name = 'dmtoken' },
+        @{ Key = 'HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\Enrollment';       Name = 'dmtoken' },
+        @{ Key = 'HKLM:\SOFTWARE\Policies\Google\Chrome';                      Name = 'CloudManagementEnrollmentToken' }
+    )
+    foreach ($probe in $probes) {
+        $item = Get-ItemProperty -Path $probe.Key -ErrorAction SilentlyContinue
+        if ($item -and ($item.PSObject.Properties.Name -contains $probe.Name) -and $item.($probe.Name)) {
+            return $true
+        }
+    }
+
+    # Then the Windows side, which covers domain and Entra joins.
     try {
         $status = & dsregcmd /status 2>$null | Out-String
         return ($status -match 'AzureAdJoined\s*:\s*YES') -or
@@ -143,11 +162,15 @@ if (-not $targets) {
 
 if (-not $Remove -and -not $Force -and -not (Test-DeviceManaged)) {
     Write-Warning @'
-This machine is not enterprise managed - not domain-joined, not Entra-joined,
-not enrolled in Chrome Enterprise Core - and no Chromium browser will
+This machine does not look enterprise managed - no Chrome Enterprise Core
+enrolment token, no domain join, no Entra join - and no Chromium browser will
 force-install an extension from outside its own web store on such a machine.
 The policy would be read and blanked. Nothing was written.
 
+If chrome://management already names your organisation, this check is simply
+wrong: run enroll-chrome-management.ps1 so the token is on this machine, or
+re-run with -Force.
+
 Three ways forward:
 
   1. Load extension\ unpacked. It has no update channel, but it reloads itself