Chrome on Windows

Three ways, depending on how your computers are managed. Each installs SourceSecure for every Chrome profile on the computer, keeps it updated from the Chrome Web Store, pins it to the toolbar, and stops anybody removing or disabling it.

Extension ID: bicelplgpeknobhaandbndecidlmeook Update URL: https://clients2.google.com/service/update2/crx

Group Policy (Active Directory)

1. Download Google's Chrome policy templates from https://chromeenterprise.google/browser/download/ ("Chrome policy templates") and copy chrome.admx and en-US\chrome.adml into your central store (\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions).
2. In Group Policy Management, edit a GPO linked to the computers' OU.
3. Go to Computer Configuration > Policies > Administrative Templates > Google > Google Chrome > Extensions.
4. Open Configure the list of force-installed apps and extensions, set it to Enabled, click Show, and add: bicelplgpeknobhaandbndecidlmeook;https://clients2.google.com/service/update2/crx
5. Optional, recommended: open Extension management settings, enable it, and paste the contents of files/chrome-extension-settings.json on one line. This pins the icon to the toolbar.
6. Optional, recommended: Google Chrome > Incognito mode availability = Incognito mode disabled. Extensions do not run in Incognito windows by default, so AI sites used there are unprotected.
7. Run gpupdate /force on a test computer and check it with verify.md.

Microsoft Intune

1. Devices > Configuration > Create > New policy, platform Windows 10 and later, profile type Settings catalog.
2. Add settings: search Google Chrome, category Extensions:
   • Configure the list of force-installed apps and extensions: Enabled, value bicelplgpeknobhaandbndecidlmeook;https://clients2.google.com/service/update2/crx
   • Extension management settings (optional): Enabled, value the one-line contents of files/chrome-extension-settings.json
3. Optional: category Google Chrome, Incognito mode availability: Incognito mode disabled.
4. Assign to a device group and check one computer with verify.md.

If the Google Chrome settings are not in your settings catalog, import Google's ADMX templates first (Devices > Configuration > Import ADMX).

A registry file (small offices, no domain)

On each computer, as an administrator, double-click files/chrome-windows.reg and accept, then restart Chrome. It writes the same policies as above under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome, including Incognito off.

If the computer already force-installs other extensions, open the file in Notepad first and change "1" to the next unused number under ExtensionInstallForcelist, or it will replace the existing first entry.

Removing it later

Remove the policy (or delete the ExtensionInstallForcelist value you added) and run gpupdate /force. Chrome uninstalls a force-installed extension when its policy is gone.