Force Install Extensions Gpo Chrome (2026)

Last updated: April 17, 2026

Chrome Force Install Extensions via GPO: Enterprise Deployment Guide

Managing Chrome extensions across an enterprise Windows environment requires a systematic approach. Group Policy Objects provide a reliable mechanism to push mandatory extensions to Chrome browsers without user intervention. This guide walks through the practical steps for deploying forced Chrome extensions via GPO, targeting developers and power users who handle Windows infrastructure.

Understanding Chrome Extension Management via GPO

Chrome supports enterprise extension management through Administrative Templates and specific registry keys. Unlike Chrome’s built-in cloud management (which requires Google Admin console), GPO-based deployment works entirely on-premises and applies to any Windows domain environment.

The mechanism relies on the Chrome Administrative Template and a specific policy setting that defines a list of extension IDs to force-install. When Chrome launches, it checks this policy and automatically installs the specified extensions for all users in the affected Organizational Units.

Prerequisites for GPO-Based Extension Deployment

Before configuring the policy, ensure your environment meets these requirements:

Windows Server 2016 or later for Group Policy Management
Chrome Browser version 65 or higher (earlier versions used a different mechanism)
The Chrome Administrative Template files (ADMX/ADML) imported into your domain
Extension IDs for the extensions you want to deploy

Downloading Chrome Administrative Templates

Microsoft maintains Chrome policy templates through the Chrome Browser Enterprise documentation. Download the latest templates from Google’s official documentation, which include both Chrome and Chromium Edge policies.

Extract the.admx files and copy them to your Domain Controller’s Policy Definitions folder (typically C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions\). This makes the Chrome policies available in the Group Policy Editor.

Configuring the Force Install Policy

Open Group Policy Management, create or edit a GPO targeting your desired Organizational Unit, and navigate to Computer Configuration → Administrative Templates → Google → Google Chrome → Extensions.

Locate the “Configure the list of force-installed apps and extensions” policy setting. Enable this policy and configure the extension list in the specified format.

Extension List Format

The policy accepts extension IDs in this format:

[extension-id1];[extension-id2];[extension-id3]

Each extension ID is a 32-character alphanumeric string found in the Chrome Web Store URL. For example, the URL https://chromewebstore.google.com/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm shows the extension ID as cjpalhdlnbpafiamejdnhcphjbkeiagm.

Force Installing Common Extensions

A typical enterprise deployment might include an ad blocker, a password manager, and a developer tool:

cjpalhdlnbpafiamejdnhcphjbkeiagm;ojhegnihnhjbhjbcphidgfddhddlnao;hnimpnehipmdihdhkpncijkflmbohkd

Breaking this down:

cjpalhdlnbpafiamejdnhcphjbkeiagm. uBlock Origin
ojhegnihnhjbhjbcphidgfddhdlnao. LastPass
hnimpnehipmdihdhkpncijkflmbohkd. JSON Viewer

When users log in and launch Chrome, these three extensions install automatically without any user action or confirmation dialog.

Testing Your Configuration

Before rolling out broadly, test the deployment in a controlled environment. The verification process involves checking both the policy application and the actual extension installation.

Verifying Policy Application

Run gpresult /r on a test workstation to confirm the GPO is applying correctly. Look for your extension policy in the Computer Configuration section.

You can also check the Windows Registry directly. The policy values store under:

HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist

Checking Extension Installation

Open Chrome and navigate to chrome://extensions. Force-installed extensions display a small gear icon next to the enable/disable toggle, indicating they were installed by administrator policy. These extensions cannot be uninstalled or disabled by the user.

For programmatic verification, Chrome provides enterprise diagnostic information through chrome://policy. This page shows all applied policies, including your extension list.

Handling Extension Updates

One significant advantage of GPO-based deployment is automatic update handling. Chrome automatically updates force-installed extensions just as it does with regular extensions. You do not need to repush extensions for minor version updates.

However, when deploying new extensions or removing existing ones, update your GPO accordingly. The next policy refresh (typically 90 minutes by default, or use gpupdate /force) propagates changes to workstations.

Advanced: Using Extension Update URLs

By default, force-installed extensions pull updates from the Chrome Web Store. For organizations with restricted internet access, configure an internal update server using the “Extension Update URL” policy:

Enable “Configure extension update settings”
Set “Extension update URL” to your internal server
Host the extension CRX files on your internal server with appropriate update XML

This configuration suits air-gapped environments where Chrome cannot reach Google’s update infrastructure.

Troubleshooting Common Issues

Several issues commonly arise during GPO extension deployment:

Extensions not installing: Verify the extension ID is correct and the Chrome policy template loaded properly. Check that the policy path matches (Computer Configuration, not User Configuration).

User can disable extensions: Ensure you also enable “Configure extension settings” and set appropriate restrictions. The force-install policy alone does not prevent users from disabling extensions after installation.

Policy not applying: Run gpresult /h report.html for a detailed breakdown. Confirm the target OU contains your test workstation and no conflicting GPOs exist with higher precedence.

Automating Extension ID Discovery

When deploying multiple extensions, programmatically extracting extension IDs speeds up the process. A simple PowerShell script can parse Chrome Web Store URLs:

$urls = @(
 "https://chromewebstore.google.com/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm",
 "https://chromewebstore.google.com/detail/json-viewer/bgmihaildoheoenhddlbgkkiplkjcola"
)
$extensionIds = $urls | ForEach-Object {
 $_ -replace '.*/detail/[^/]+/', ''
}
$extensionIds -join ';'

This extracts the extension IDs and formats them for direct use in your GPO configuration.

Blocking Unauthorized Extensions with AllowList Policy

Force-installing approved extensions is only half of an enterprise extension governance strategy. The complementary policy blocks installation of any extension not on your approved list, preventing users from bypassing your security controls by installing unapproved tools.

Configure the allow-list policy in the same Extensions section of the Chrome Administrative Template:

Enable “Configure extension installation allow/blocklist”
Set the block rule to * (block all)
Enable “Configure the list of allowed extensions” and add your approved extension IDs

The final configuration should look like this in the registry:

HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist
 1 = *
HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist
 1 = cjpalhdlnbpafiamejdnhcphjbkeiagm (uBlock Origin)
 2 = hnimpnehipmdihdhkpncijkflmbohkd (JSON Viewer)
 3 = [additional approved IDs]

Extensions already installed by users that are not on the allowlist will be automatically disabled when the GPO applies. Users will see a message explaining that their administrator has blocked the extension.

For developer workstations that need more flexibility, create a separate GPO with a more permissive allowlist and apply it to the Developers OU rather than the broader organization. This gives your development team access to debugging tools while keeping tighter controls on standard user machines.

The PowerShell script from earlier can generate the allowlist registry values automatically from a maintained CSV:

approved-extensions.csv format: name,extensionId
Import-Csv approved-extensions.csv | ForEach-Object -Begin {$i=1} -Process {
 $regPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist"
 Set-ItemProperty -Path $regPath -Name $i -Value $_.extensionId
 $i++
 Write-Output "Added: $($_.name) ($($_.extensionId))"
}

Keep the CSV in version control alongside your Group Policy documentation. This creates an auditable record of which extensions are approved, who approved them, and when they were added. useful for compliance reviews and security audits.

Summary

GPO-based Chrome extension deployment provides a solid, on-premises mechanism for enterprise environments. By configuring the Administrative Template and specifying extension IDs in the force-install policy, you ensure mandatory extensions are present on all managed workstations. The approach requires no user interaction, prevents removal by end users, and handles updates automatically.

For developers managing Windows infrastructure, integrating extension deployment into your existing Group Policy workflows eliminates the need for separate extension management solutions. Test thoroughly, maintain accurate extension IDs, and document your configuration for future maintenance.

Auditing Extension Deployments

After deploying extensions via GPO, maintaining visibility into which extensions are actually installed across your fleet is important for security compliance. Not every machine applies GPOs on schedule, and edge cases. machines offline during policy refresh, manual uninstalls via registry edits. can leave your fleet in an inconsistent state.

Build a simple audit script that runs via Group Policy Preferences or your endpoint management tool:

Get Chrome extension registry for all users
$extensionPath = "HKLM:\SOFTWARE\Google\Chrome\Extensions"
if (Test-Path $extensionPath) {
 Get-ChildItem $extensionPath | ForEach-Object {
 $id = $_.PSChildName
 $version = (Get-ItemProperty $_.PSPath).version
 [PSCustomObject]@{
 Computer = $env:COMPUTERNAME
 ExtensionId = $id
 Version = $version
 Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm"
 }
 }
} | Export-Csv "\\fileserver\extensions-audit\$env:COMPUTERNAME.csv" -NoTypeInformation

Schedule this script to run weekly via a logon script GPO and collect the CSVs on your file server. Aggregate them periodically to identify machines that are missing required extensions or running outdated versions.

For organizations with more sophisticated endpoint management, most modern platforms (Intune, SCCM, Jamf) provide native extension inventory reporting. The registry approach above serves as a lightweight alternative when dedicated tooling is not available.

Try it: Paste your error into our Error Diagnostic for an instant fix.

This took me 3 hours to figure out. I put it in a CLAUDE.md so I'd never figure it out again. Now Claude gets it right on the first try, every project. 16 framework templates. Next.js, FastAPI, Laravel, Rails, Go, Rust, Terraform, and 9 more. Each one 300+ lines of "here's exactly how this stack works." Copy into your project. Done. **[See the templates →](https://zovo.one/lifetime?utm_source=ccg&utm_medium=cta-config&utm_campaign=chrome-force-install-extensions-gpo)** $99 once. Yours forever. I keep adding templates monthly.