Managing Chromium Extensions via Group Policy

This article provides a quick and comprehensive guide for enterprise administrators on how to manage Chromium web browser extensions using Windows Group Policy. By implementing specific administrative templates, administrators can centrally control their organization's browser environment, ensuring required security and productivity extensions are automatically force-installed while simultaneously blocking unauthorized or malicious add-ons.

Prerequisites

Before configuring extension policies, you must install the Chromium Administrative Templates (ADMX and ADML files).

  1. Download the Chromium policy templates from the official Chromium project repository.
  2. Copy the .admx file to your Active Directory Central Store (typically \\yourdomain.com\SYSVOL\yourdomain.com\Policies\PolicyDefinitions) or the local C:\Windows\PolicyDefinitions folder.
  3. Copy the language-specific .adml file (e.g., en-US) to the corresponding language subfolder.
  4. Open the Group Policy Management Console (GPMC), create a new Group Policy Object (GPO) or edit an existing one, and navigate to the following path: Computer Configuration > Policies > Administrative Templates > Chromium > Extensions

Note: You can also apply these settings under User Configuration if you prefer to target specific users rather than machines.

Finding the Extension ID

To block or force-install an extension, you need its unique 32-character Extension ID.

  1. Open the Chromium browser and navigate to the Chrome Web Store.
  2. Search for and click on the target extension.
  3. Look at the URL in the browser's address bar. The Extension ID is the 32-character string of letters at the very end of the URL (for example: cjpalhdlnbpafiamejdnhcphjbkeiagm).

How to Block Specific Extensions

Blocking an extension prevents users from installing it and automatically removes it if it is already installed.

  1. In the GPMC, navigate to the Chromium > Extensions folder.
  2. Double-click the policy named Configure extension installation blocklist.
  3. Select Enabled.
  4. In the Options pane, click the Show... button.
  5. In the Value column, enter the 32-character Extension ID of the extension you want to block. You can add multiple IDs on separate rows.
  6. Optional: To block all extensions by default, enter an asterisk (*) as the value. You can then use the Configure extension installation allowlist policy to permit only administrator-approved extensions.
  7. Click OK to close the list, then click Apply and OK to save the policy.

How to Force-Install Extensions

Force-installing an extension silently installs it on the target browsers and prevents users from disabling or uninstalling it.

  1. In the GPMC, navigate to the Chromium > Extensions folder.
  2. Double-click the policy named Configure the list of force-installed apps and extensions.
  3. Select Enabled.
  4. In the Options pane, click the Show... button.
  5. Enter the Extension ID followed immediately by a semicolon and the extension's update URL, with no spaces.
    • If the extension is hosted on the Chrome Web Store, use Google's standard update URL: https://clients2.google.com/service/update2/crx
    • The complete string must follow this exact format: extension_id;update_url
    • Example: cjpalhdlnbpafiamejdnhcphjbkeiagm;https://clients2.google.com/service/update2/crx
  6. Click OK to close the list, then click Apply and OK to save the policy.

Applying and Verifying the Policies

Once the GPO is configured, link it to the Organizational Unit (OU) containing your target computers or users.

  1. On a target client workstation, open the Command Prompt and run the command gpupdate /force to immediately pull the new Group Policy settings.
  2. Open the Chromium browser and type chrome://policy into the address bar, then press Enter.
  3. Click the Reload policies button at the top of the page.
  4. Verify that ExtensionInstallBlocklist and ExtensionInstallForcelist are displayed in the table, their Status is listed as OK, and the correct Extension IDs are visible in the Policy value column.
  5. Navigate to chrome://extensions to confirm the force-installed extensions are active and feature an enterprise building icon, indicating they are managed by your organization.