Brandon LiandClaude Opus 5
a103d7b6f1
Enrolling is what lifts the off-store restriction without joining a domain, and it is one machine-scoped token in both places Chrome looks: HKLM on Windows, a file under /etc/opt/chrome/policies/enrollment on Linux. Both scripts take --remove, and both say plainly that removing the token locally does not release the seat in the Admin console. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
85 lines
3.3 KiB
PowerShell
85 lines
3.3 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Enrol this machine's Chrome in Chrome Enterprise Core.
|
|
|
|
.DESCRIPTION
|
|
Chrome refuses to force-install an extension from outside its own web store
|
|
unless the machine counts as enterprise managed. Enrolment is the way to
|
|
qualify without joining a domain: one machine-level token, and from the next
|
|
launch Chrome takes policy from the Google Admin console and the off-store
|
|
restriction lifts. install-extension-policy.ps1 then works as intended.
|
|
|
|
The token comes from the Admin console: Devices > Chrome > Managed browsers >
|
|
the enrollment-token button. One token can enrol any number of machines, and
|
|
it is only used at enrolment.
|
|
|
|
Needs an elevated PowerShell — the token is machine-scoped, and Chrome does
|
|
not read it from the user hive.
|
|
|
|
.EXAMPLE
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-management.ps1 -Token abcd1234-...
|
|
#>
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory = $true, ParameterSetName = 'Enrol')]
|
|
[string]$Token,
|
|
|
|
# Refuse to start Chrome at all if enrolment fails. Sound on a fleet, risky
|
|
# on a trading PC: a revoked token would leave you with no browser.
|
|
[Parameter(ParameterSetName = 'Enrol')]
|
|
[switch]$Mandatory,
|
|
|
|
[Parameter(Mandatory = $true, ParameterSetName = 'Remove')]
|
|
[switch]$Remove
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
|
|
[Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
throw 'Run this from an elevated PowerShell — the enrolment token is machine-level.'
|
|
}
|
|
|
|
$key = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
|
|
if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
|
|
|
|
if ($Remove) {
|
|
foreach ($name in 'CloudManagementEnrollmentToken', 'CloudManagementEnrollmentMandatory') {
|
|
if ($null -ne (Get-ItemProperty -Path $key -Name $name -ErrorAction SilentlyContinue)) {
|
|
Remove-ItemProperty -Path $key -Name $name
|
|
Write-Host "Removed $name"
|
|
}
|
|
}
|
|
Write-Host @"
|
|
|
|
Restart Chrome. Note this stops Chrome asking for policy, but does not undo the
|
|
enrolment on Google's side — delete the browser from Devices > Chrome > Managed
|
|
browsers as well, or it keeps a seat and shows as stale.
|
|
"@
|
|
exit 0
|
|
}
|
|
|
|
New-ItemProperty -Path $key -Name 'CloudManagementEnrollmentToken' `
|
|
-Value $Token -PropertyType String -Force | Out-Null
|
|
Write-Host "Wrote CloudManagementEnrollmentToken to $key"
|
|
|
|
if ($Mandatory) {
|
|
New-ItemProperty -Path $key -Name 'CloudManagementEnrollmentMandatory' `
|
|
-Value 1 -PropertyType DWord -Force | Out-Null
|
|
Write-Host 'Enrolment is now mandatory — Chrome will not start unenrolled.'
|
|
}
|
|
|
|
Write-Host @"
|
|
|
|
Next:
|
|
1. Restart Chrome completely (check Task Manager for stray chrome.exe).
|
|
2. chrome://policy should name the Admin console as a policy source, and
|
|
chrome://management should say the browser is managed.
|
|
3. The machine appears under Devices > Chrome > Managed browsers.
|
|
4. Then install the extension, which is no longer blocked:
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1 -Browser Chrome
|
|
Or skip that and force-install it from the Admin console instead, which
|
|
covers every enrolled machine at once.
|
|
"@
|