Forum Discussion

JBrunsden's avatar
JBrunsden
Copper Contributor
Sep 25, 2020

ExtensionInstallForcelist - Multiple GPOs

Hi,   I'm trying to utilize the ExtensionInstallForcelist GPO to install extensions silently for our users.   We want to be able to distribute some extensions globally to all customers (using a g...
ashishpoddar's avatar
ashishpoddar
Icon for Microsoft rankMicrosoft

Hi JBrunsden

 

Could you share the conflict error you are seeing?

 

Thanks

Ashish.  

JBrunsden's avatar
JBrunsden
Copper Contributor
Sep 29, 2020

Hi ashishpoddar,

 

Below is the screenshot from the edge://policy/ screen.

 

I did initially set this up with both exceptions defined in separate GPOs under Computer Config but same error as above even when one is defined in Computer and another in User (still separate GPOs).

 

Thanks,

 

John

 

 

    • ashishpoddar's avatar
      ashishpoddar
      Icon for Microsoft rankMicrosoft
      Oct 11, 2020

      Hi JBrunsden

       

      The suggestion here is to always apply the device policies after the user policies, so device will always win when there is a conflict between them.

       

      Could you try this approach and confirm if this works?

       

      Thanks

      Ashish.

      • JBrunsden's avatar
        JBrunsden
        Copper Contributor
        Oct 11, 2020

        ashishpoddar Hi, 

         

        Unfortunately that just isn't possible with a current scenario, we enforce a Cyber GPO that pushes the ATP extension among other things, so this will always be above any user policies.

         

        I think the issue here would ultimately be resolved if the  ExtensionInstallForcelist could just be populated with values from multiple GPOs, even in two separate Device GPOs one has to take precedence of the other and we cannot implement the way you described because of the reason above.

        It looks like Chrome has GPOs that could work around this:

        https://cloud.google.com/docs/chrome-enterprise/policies/?policy=PolicyDictionaryMultipleSourceMergeList

        https://cloud.google.com/docs/chrome-enterprise/policies/?policy=PolicyListMultipleSourceMergeList

         

        This presumably allows for separate values to be merged, so something like this could work in Edge?

         

        For now we will probably have to look at putting all our extensions in one policy, but as initially stated, this isn't really flexible in an Enterprise environment for certain use cases.

         

        Thanks

         

Resources