Brandon LiandClaude Opus 5
a103d7b6f1
Enrolling is what lifts the off-store restriction without joining a domain, and it is one machine-scoped token in both places Chrome looks: HKLM on Windows, a file under /etc/opt/chrome/policies/enrollment on Linux. Both scripts take --remove, and both say plainly that removing the token locally does not release the seat in the Admin console. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
1.8 KiB
Bash
Executable File
48 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Enrol this machine's Chrome in Chrome Enterprise Core.
|
|
#
|
|
# The Linux counterpart to enroll-chrome-management.ps1. Chrome reads the token
|
|
# from a file under /etc at startup, so this needs root, and it applies to every
|
|
# user on the machine.
|
|
#
|
|
# sudo scripts/enroll-chrome-management.sh <token>
|
|
# sudo scripts/enroll-chrome-management.sh --remove
|
|
#
|
|
# Chrome only — Chromium builds have no cloud-management support, so a Chromium
|
|
# install cannot be enrolled and stays subject to the off-store restriction.
|
|
set -euo pipefail
|
|
|
|
DIR=/etc/opt/chrome/policies/enrollment
|
|
TOKEN_FILE="$DIR/CloudManagementEnrollmentToken"
|
|
|
|
info() { printf ' %s\n' "$1"; }
|
|
fail() { printf '\n\033[1;31mERROR: %s\033[0m\n' "$1" >&2; exit 1; }
|
|
|
|
[ "$(id -u)" -eq 0 ] || fail "run this with sudo — the token lives under /etc"
|
|
[ $# -ge 1 ] || fail "usage: $0 <enrollment-token> | --remove"
|
|
|
|
if [ "$1" = "--remove" ]; then
|
|
rm -f "$TOKEN_FILE" "$DIR/CloudManagementEnrollmentOptions"
|
|
info "removed $TOKEN_FILE"
|
|
info "Restart Chrome. This stops it asking for policy, but does not undo the"
|
|
info "enrolment on Google's side — delete the browser from Devices > Chrome >"
|
|
info "Managed browsers too."
|
|
exit 0
|
|
fi
|
|
|
|
[ -d /etc/opt/chrome ] || fail "no /etc/opt/chrome — this is for Google Chrome, not Chromium"
|
|
|
|
mkdir -p "$DIR"
|
|
# The file must contain the token and nothing else: no quotes, no newline noise,
|
|
# no filename extension. Chrome reads it verbatim.
|
|
printf '%s' "$1" > "$TOKEN_FILE"
|
|
chmod 644 "$TOKEN_FILE"
|
|
info "wrote $TOKEN_FILE"
|
|
|
|
echo
|
|
info "Next:"
|
|
info " 1. Restart Chrome completely."
|
|
info " 2. chrome://policy should name the Admin console as a policy source, and"
|
|
info " chrome://management should say the browser is managed."
|
|
info " 3. Then: sudo scripts/install-extension-policy.sh"
|