A force install Chrome extension policy is a browser setting, pushed by Group Policy or written to the registry, that tells Chrome or Edge to install a named extension on every profile and to stop the user from removing it. It is the only reliable way to put a security extension on hundreds of machines. The policy is one registry value: an extension ID, a semicolon, and the URL of an update manifest. Get any part of that line wrong and nothing happens. The browser does not warn you, the user does not notice, and the extension is simply not there. This guide covers how the policy works, how to host your own extension, how to check it landed, and how Tracemark uses it.
Why a security extension cannot be optional
Most of what matters leaves a company through a browser tab: files to personal cloud storage, text into web mail, confidential paragraphs into an AI chat. An endpoint agent can see the clipboard and the file system, but the contents of a form field inside Chrome are only visible from inside Chrome. That is what a browser extension is for.
If the user can disable it, it is not a control. An extension installed by hand sits in chrome://extensions with a toggle next to it. A user who is about to paste a customer list into a chatbot will find that toggle. The force-install policy removes the toggle, blocks uninstall, and reinstalls the extension if it goes missing. The browser treats it as part of the managed configuration, the same as a home page or a proxy setting.
Edge is Chromium and needs the same treatment. Most estates run both, usually without planning to.
How the force install Chrome extension policy works
Chromium browsers read enterprise policies from a fixed place. On Windows that is the registry under HKLM\Software\Policies\Google\Chrome for Chrome and HKLM\Software\Policies\Microsoft\Edge for Edge. Group Policy writes those keys from the ADMX templates. Anything else that can write to HKLM, such as an endpoint agent running as SYSTEM, can write them too.
The relevant policy is ExtensionInstallForcelist. It is a list, so each entry is a numbered value under the key:
`` HKLM\Software\Policies\Google\Chrome\ExtensionInstallForcelist 1 = "abcdefghijklmnopabcdefghijklmnop;https://clients2.google.com/service/update2/crx" 2 = "ponmlkjihgfedcbaponmlkjihgfedcba;https://updates.example.com/dlp/update.xml" ``
Each value has two parts:
- The extension ID, 32 lowercase letters from
atop. It is derived from the public key the extension was packed with, so it never changes between versions as long as you keep the same key. - The update URL. For a Web Store extension this is the Chrome Web Store update service. For a self-hosted extension it is the URL of an XML update manifest that you serve.
Microsoft documents the Edge version of the policy at learn.microsoft.com and Google documents the Chrome version at chromeenterprise.google. Read the one for the browser you have. The names match, the semantics match, but the registry path does not.
A second policy usually goes with it: ExtensionInstallBlocklist set to * and ExtensionInstallAllowlist naming the ones you force. Default deny for extensions is worth doing. Most leaks through "productivity" extensions are not malicious, just an extension with permission to read every page sending page content to a server you have never heard of.
Web Store or self-hosted
The Chrome Web Store is the easy route for an extension someone else publishes. For your own extension, or a vendor's extension that is not in the store, you self-host. Self-hosting means three things:
- A
.crxfile, packed with a private key you keep. The key is what fixes the extension ID. Lose the key and the next version has a different ID, and every forcelist entry in your estate now points at an extension that no longer exists. - An update manifest, a small XML file that lists the extension ID, the current version and the URL of the
.crx. The browser fetches this file on its own schedule, every few hours, and compares the version. If the manifest says a newer version exists, the browser downloads the.crxand swaps it in. - An HTTPS server the browser can reach from every machine, including a laptop on home Wi-Fi. If your update URL is an internal hostname and half the fleet is remote, half the fleet never updates.
Google's reference for the manifest format is in the Chrome developer docs. Despite the title, the format is the same on every platform. Chrome is strict about it. A missing codebase attribute, a version string with a letter in it, or a 302 redirect to HTTP will stop the update, and again, silently.
Serve the .crx with Content-Type: application/x-chrome-extension. Both browsers are picky about it.
Every failure mode is silent
This is the part that costs the most time. There is no error dialog anywhere in this chain. The policy is read at browser start and on a timer, the update check runs in the background, and the result is either an extension in the list or nothing.
The common reasons nothing happens:
| Symptom | Usual cause |
|---|---|
| Extension never appears on any machine | Wrong registry path (Chrome key on an Edge-only estate, or the reverse), or policy written under HKCU |
| Appears on some machines, not others | Update URL unreachable from those machines (DNS, proxy, remote users) |
| Old version stays installed forever | Update manifest still lists the old version, or the version string did not increase in the right place |
| Appears, then vanishes after an update | Extension repacked with a new key, so the ID changed |
| "Blocked by your administrator" in chrome://extensions | A blocklist policy also matches, and blocklist wins unless the allowlist names the ID |
| Installed but does nothing | Extension's own backend URL is blocked, or the extension needs a config the policy did not deliver |
There is also a subtler case: a stale copy of the line. If an admin once typed the forcelist by hand into a Group Policy object, and the update URL has since moved, Group Policy keeps writing the old URL over whatever else writes the key, and the fleet quietly freezes on the last version served from the old address. The fix is to write the policy from one place only.
How to check it landed
Do not trust the policy. Check the result.
On one machine, open chrome://policy (or edge://policy) and look for ExtensionInstallForcelist. The page shows the value the browser actually read. If the value is there but the extension is not, go to chrome://extensions, enable Developer mode, and press "Update". The extension's details show the version and whether it is managed by policy.
Across a fleet, you need the same check from every machine, which means an agent. Reading the registry tells you what was asked. Reading the extension's install folder under %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\<id>\<version> tells you what happened. Record both. The gap between them is your to-do list.
Checklist: force install done properly
- Decide which browsers are in the estate. Query the inventory, do not assume Chrome only.
- Keep the packing key in a vault. Document who can access it. The key is the extension ID.
- Host the update manifest and the
.crxon HTTPS, reachable from off-network laptops, with the correctContent-Type. - Write
ExtensionInstallForcelistfrom exactly one place. If an agent writes it, remove the hand-typed GPO line. - Pair the forcelist with an allowlist or a default-deny blocklist, and name your extension in the allowlist.
- Bump the version in both the extension's
manifest.jsonand the update manifest in the same release. - Verify on a fleet basis: which machines report the policy, which report the extension installed, which report the expected version.
- Keep a last-resort reinstall. A profile reset can remove the extension; something should put it back without a human.
- Test in one ring first, then the rest.
How Tracemark does it
Tracemark's AI Security checks run inside the browser, so the Tracemark extension has to be on every Chrome and Edge profile. Tracemark installs it by policy. Browser policies for Chrome and Edge are part of Endpoint Control, delivered by the same agent that handles every other endpoint policy, and managed from the one console.
That means the forcelist line is not typed by hand into a Group Policy object. It comes from the console, through the agent, on every endpoint the agent runs on. One source for the line, one place to look when it is wrong.
Once the extension is in place it is the sensor for the browser channels. Every prompt to an AI tool is checked before it is sent. Confidential text can be masked, so the question goes through and the secret stays, or blocked. Files dropped into an AI chat are checked like uploads. The AI activity log shows who sent what, to which tool, and from which file, and the inventory lists every AI tool in use as sanctioned, blocked or seen. Each decision lands in the Incidents queue with who, what, channel, policy and outcome.
For what the extension actually enforces, see how to stop employees pasting confidential data into ChatGPT and Shadow AI: how to find every AI tool your employees use. For the rest of the endpoint policy set that ships through the same agent, see application control with default deny.
Frequently asked questions
Does ExtensionInstallForcelist work for Edge as well as Chrome?
Yes. Edge reads the same policy name with the same value format, but from its own registry path under HKLM\Software\Policies\Microsoft\Edge. An extension packed for Chrome installs in Edge unchanged as long as the update URL is reachable and the .crx is served with the right content type.
Can the user remove a force-installed extension?
No. The browser hides the remove button and the enable toggle for a policy-installed extension, and reinstalls it on the next policy refresh if it is missing. A user with local admin can delete the registry key, which is one more reason to end standing local admin.
Why does the extension show up on some PCs and not others?
Almost always the update URL. The machines that fail cannot reach the manifest, usually because of DNS, a proxy exception, or a remote laptop that cannot see an internal hostname. Check chrome://policy on one failing machine first, then try fetching the update URL from that machine in a browser tab.
What happens if I lose the extension's packing key?
The next version you pack gets a new extension ID. Every forcelist entry pointing at the old ID stops matching, and the old extension will never update. You would have to replace the forcelist line on every machine with the new ID and the users would see two extensions for a while. Treat the key like a code-signing certificate and store it accordingly.
Try it
Try Tracemark free for three months. Claim it at tracemark.ca