How to Configure Chrome Enterprise Policies and Extension Whitelisting via Registry

In corporate environments and managed workstations, allowing employees to install arbitrary browser extensions or modify critical proxy settings introduces severe data leakage and malware risks. Malicious extensions frequently hijack sessions, exfiltrate passwords, and inject unauthorized ad banners. Using Google Chrome Enterprise Policies configured via the Windows Registry, system administrators can enforce strict browser compliance, lock enterprise homepages, and enforce strict extension whitelisting.

Understanding Chrome Policy Hierarchy and Registry Paths

Google Chrome reads administrative policies from specific registry keys upon initialization:

• Machine-Level Policies (HKEY_LOCAL_MACHINE): Enforced globally across all local user accounts on the machine. Standard unprivileged users cannot override or bypass these directives.
• User-Level Policies (HKEY_CURRENT_USER): Applied per-user session.
• Key Location: Enterprise directives reside under:
  HKEY_LOCAL_MACHINESOFTWAREPoliciesGoogleChrome

Configuring Mandatory Extension Whitelisting via Registry

The most effective strategy to prevent rogue extensions is to block all extensions by default using wildcard asterisks (*), while explicitly whitelisting authorized extension IDs:

Open an elevated PowerShell prompt or administrative terminal and execute the following commands:

# Create policy subkeys
New-Item -Path "HKLM:SOFTWAREPoliciesGoogleChromeExtensionInstallBlocklist" -Force
New-Item -Path "HKLM:SOFTWAREPoliciesGoogleChromeExtensionInstallAllowlist" -Force

# Block all extension installations by default
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesGoogleChromeExtensionInstallBlocklist" -Name "1" -Value "*"

# Whitelist approved extension IDs (e.g., uBlock Origin and Password Manager)
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesGoogleChromeExtensionInstallAllowlist" -Name "1" -Value "cjpalhdlnbpafiamejdnhcphjbkeiagm"
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesGoogleChromeExtensionInstallAllowlist" -Name "2" -Value "nngceckbapebfimnlniiiahkandclblb"

When users attempt to install any unauthorized extension from the Chrome Web Store, Chrome displays an administrative restriction message stating: “Your administrator has blocked this extension.”

Force-Installing Mission-Critical Enterprise Extensions

To automatically deploy corporate security tools or password managers silently without user intervention, use ExtensionInstallForcelist:

New-Item -Path "HKLM:SOFTWAREPoliciesGoogleChromeExtensionInstallForcelist" -Force

# Deploy extension ID with automatic update URL
$extPolicy = "cjpalhdlnbpafiamejdnhcphjbkeiagm;https://clients2.google.com/service/update2/crx"
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesGoogleChromeExtensionInstallForcelist" -Name "1" -Value $extPolicy

Upon next browser launch, Chrome downloads, installs, and locks the extension into the browser, preventing users from disabling or uninstalling it.

Enforcing Corporate Homepages and Password Manager Policies

Configure consistent startup URLs and restrict insecure password storage:

# Configure mandatory homepage
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesGoogleChrome" -Name "HomepageLocation" -Value "https://digitash.com"
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesGoogleChrome" -Name "HomepageIsNewTabPage" -Value 0 -Type DWord

# Disable built-in browser credential caching to force enterprise SSO
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesGoogleChrome" -Name "PasswordManagerEnabled" -Value 0 -Type DWord

Auditing and Validating Applied Policies in Chrome

To verify that registry modifications have successfully applied:

1. Launch Google Chrome.
2. In the address bar, type chrome://policy and press Enter.
3. Click the Reload policies button.
4. Review the Chrome Policies table. Confirm that ExtensionInstallBlocklist, ExtensionInstallAllowlist, and PasswordManagerEnabled appear marked with status OK and level Mandatory.