Brandon LiandClaude Opus 5
35dd15d584
Both setup scripts ended by telling you to load the folder unpacked, which is the one install that cannot update itself - and the policy install they moved to next does nothing on an unmanaged machine. Enrolment is the step that actually matters: with it, the extension arrives from the Admin console already force-installed, and there is nothing else to configure on the box. So step 7 now asks for an enrolment token instead. The Windows script elevates itself for it - the token is machine-scoped, and that is the only UAC prompt in the whole install. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
107 lines
4.3 KiB
PowerShell
107 lines
4.3 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Enrol this machine's Chrome in Chrome Enterprise Core.
|
|
|
|
.DESCRIPTION
|
|
Chrome refuses to force-install an extension from outside its own web store
|
|
unless the machine counts as enterprise managed. Enrolment is the way to
|
|
qualify without joining a domain: one machine-level token, and from the next
|
|
launch Chrome takes policy from the Google Admin console and the off-store
|
|
restriction lifts. install-extension-policy.ps1 then works as intended.
|
|
|
|
The token comes from the Admin console: Devices > Chrome > Managed browsers >
|
|
the enrollment-token button. One token can enrol any number of machines, and
|
|
it is only used at enrolment.
|
|
|
|
Needs an elevated PowerShell — the token is machine-scoped, and Chrome does
|
|
not read it from the user hive.
|
|
|
|
.EXAMPLE
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-management.ps1 -Token abcd1234-...
|
|
#>
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory = $true, ParameterSetName = 'Enrol')]
|
|
[string]$Token,
|
|
|
|
# Refuse to start Chrome at all if enrolment fails. Sound on a fleet, risky
|
|
# on a trading PC: a revoked token would leave you with no browser.
|
|
[Parameter(ParameterSetName = 'Enrol')]
|
|
[switch]$Mandatory,
|
|
|
|
[Parameter(Mandatory = $true, ParameterSetName = 'Remove')]
|
|
[switch]$Remove,
|
|
|
|
# Fail instead of asking for elevation. Also the loop-breaker: the elevated
|
|
# copy is launched with this set, so it can never spawn another.
|
|
[switch]$NoElevate
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
|
|
[Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
if ($NoElevate) {
|
|
throw 'Run this from an elevated PowerShell — the enrolment token is machine-level.'
|
|
}
|
|
|
|
# Relaunch elevated rather than making the caller do it. setup-windows.bat
|
|
# runs unelevated on purpose — nothing else it does needs admin — so this is
|
|
# the one UAC prompt in the whole install, and it is raised here where the
|
|
# arguments are already parsed and can be passed on intact.
|
|
Write-Host 'Asking for administrator rights — the enrolment token is machine-level.'
|
|
$psArgs = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$PSCommandPath`"", '-NoElevate')
|
|
if ($Remove) { $psArgs += '-Remove' }
|
|
else {
|
|
$psArgs += @('-Token', $Token)
|
|
if ($Mandatory) { $psArgs += '-Mandatory' }
|
|
}
|
|
|
|
$elevated = Start-Process -FilePath (Get-Process -Id $PID).Path -Verb RunAs -Wait -PassThru `
|
|
-ArgumentList $psArgs
|
|
exit $elevated.ExitCode
|
|
}
|
|
|
|
$key = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
|
|
if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
|
|
|
|
if ($Remove) {
|
|
foreach ($name in 'CloudManagementEnrollmentToken', 'CloudManagementEnrollmentMandatory') {
|
|
if ($null -ne (Get-ItemProperty -Path $key -Name $name -ErrorAction SilentlyContinue)) {
|
|
Remove-ItemProperty -Path $key -Name $name
|
|
Write-Host "Removed $name"
|
|
}
|
|
}
|
|
Write-Host @"
|
|
|
|
Restart Chrome. Note this stops Chrome asking for policy, but does not undo the
|
|
enrolment on Google's side — delete the browser from Devices > Chrome > Managed
|
|
browsers as well, or it keeps a seat and shows as stale.
|
|
"@
|
|
exit 0
|
|
}
|
|
|
|
New-ItemProperty -Path $key -Name 'CloudManagementEnrollmentToken' `
|
|
-Value $Token -PropertyType String -Force | Out-Null
|
|
Write-Host "Wrote CloudManagementEnrollmentToken to $key"
|
|
|
|
if ($Mandatory) {
|
|
New-ItemProperty -Path $key -Name 'CloudManagementEnrollmentMandatory' `
|
|
-Value 1 -PropertyType DWord -Force | Out-Null
|
|
Write-Host 'Enrolment is now mandatory — Chrome will not start unenrolled.'
|
|
}
|
|
|
|
Write-Host @"
|
|
|
|
Next:
|
|
1. Restart Chrome completely (check Task Manager for stray chrome.exe).
|
|
2. chrome://policy should name the Admin console as a policy source, and
|
|
chrome://management should say the browser is managed.
|
|
3. The machine appears under Devices > Chrome > Managed browsers.
|
|
4. Then install the extension, which is no longer blocked:
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1 -Browser Chrome
|
|
Or skip that and force-install it from the Admin console instead, which
|
|
covers every enrolled machine at once.
|
|
"@
|