senofy/autofirmer-expanded
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Skip Edge on unmanaged devices instead of writing a dead policy

Browse Source 
Unmanaged Edge installs extensions from the Microsoft Store and nowhere else:
it reads ExtensionInstallForcelist, blanks the value to [BLOCKED]<id>, and
reports an invalid extension id forever after. Writing that key buys nothing
and costs a permanent policy error plus a "Managed by your organization"
badge, so the script now checks dsregcmd and skips Edge with the two ways
round it. -Force writes it anyway.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon Li
2026-08-31 13:25:39 -05:00
co-authored by Claude Opus 5
parent 8f00d8c547
commit e42e729189
3 changed files with 59 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/README.md
+16 -4
View File
@@ -93,10 +93,22 @@ powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-po
sudo scripts/install-extension-policy.sh
```
Both configure every Chromium-family browser they find — Chrome, Edge and Brave
take the same CRX, the same update manifest and the same policy, differing only
in where that policy is written. Narrow it with `-Browser Edge` if you would
rather not.
Both configure every Chromium-family browser they find, and narrowing that to
one is `-Browser Chrome`.
**Edge is the exception, and it is not one we can fix.** Unmanaged Edge installs
extensions from the Microsoft Store and nowhere else. It reads the policy and
then blanks it — `edge://policy` shows `[BLOCKED]<id>;<url>` with "This device
isn't managed by your organization" — so a self-hosted CRX cannot be installed
there at all unless the machine is domain-joined, Intune-enrolled or
Entra-joined. Chrome and Brave have no equivalent restriction. The script
detects this and skips Edge rather than leaving a permanent policy error and a
"Managed by your organization" badge behind; `-Force` overrides it.
On a machine that has to be Edge, load `extension/` unpacked there instead. It
still picks up releases: an unpacked copy reloads itself from disk when the
dashboard reports a newer version, which is what the updater has already
pulled.
The Windows script writes to the current user's policy hive and needs no
elevation; `-Scope Machine` covers every account on the box and does need an