ExtensionInstallForcelist - Multiple GPOs

%3CLINGO-SUB%20id%3D%22lingo-sub-1714152%22%20slang%3D%22en-US%22%3EExtensionInstallForcelist%20-%20Multiple%20GPOs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1714152%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20trying%20to%20utilize%20the%26nbsp%3BExtensionInstallForcelist%20GPO%20to%20install%20extensions%20silently%20for%20our%20users.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20want%20to%20be%20able%20to%20distribute%20some%20extensions%20globally%20to%20all%20customers%20(using%20a%20global%20GPO)%20and%20then%20specific%20extensions%20to%20a%20sub-set%20of%20customers%20(using%20a%20local%20specific%20GPO).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECurrently%20you%20appear%20to%20get%20a%20conflict%20message%20when%20trying%20to%20do%20this.%20It%20appears%20multiple%20extensions%20need%20to%20be%20defined%20in%20one%20GPO%20only%2C%20which%20isn't%20ideal%20for%20scenario%20above.%20Is%20it%20possible%20to%20get%20round%20this%20issue%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1714677%22%20slang%3D%22en-US%22%3ERe%3A%20ExtensionInstallForcelist%20-%20Multiple%20GPOs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1714677%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F702012%22%20target%3D%22_blank%22%3E%40JBrunsden%3C%2FA%3E%26nbsp%3BHi!%26nbsp%3B%20I'm%20checking%20with%20our%20Extension%20Team%20about%20your%20question.%26nbsp%3B%20We'll%20keep%20you%20updated%20if%20they%20have%20any%20suggestions.%26nbsp%3B%20Thanks!%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3E-Kelly%3C%2FEM%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1717640%22%20slang%3D%22en-US%22%3ERe%3A%20ExtensionInstallForcelist%20-%20Multiple%20GPOs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1717640%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F702012%22%20target%3D%22_blank%22%3E%40JBrunsden%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ECould%20you%20share%20the%20conflict%20error%20you%20are%20seeing%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%3C%2FP%3E%0A%3CP%3EAshish.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1723845%22%20slang%3D%22en-US%22%3ERe%3A%20ExtensionInstallForcelist%20-%20Multiple%20GPOs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1723845%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F318153%22%20target%3D%22_blank%22%3E%40ashishpoddar%3C%2FA%3E%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBelow%20is%20the%20screenshot%20from%20the%20%3CA%20href%3D%22edge%3A%2F%2Fpolicy%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eedge%3A%2F%2Fpolicy%2F%3C%2FA%3E%20screen.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22JBrunsden_0-1601376629344.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F222774i40D78BA205878A84%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22JBrunsden_0-1601376629344.png%22%20alt%3D%22JBrunsden_0-1601376629344.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EI%20did%20initially%20set%20this%20up%20with%20both%20exceptions%20defined%20in%20separate%20GPOs%20under%20Computer%20Config%20but%20same%20error%20as%20above%20even%20when%20one%20is%20defined%20in%20Computer%20and%20another%20in%20User%20(still%20separate%20GPOs).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EJohn%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hi,

 

I'm trying to utilize the ExtensionInstallForcelist GPO to install extensions silently for our users.

 

We want to be able to distribute some extensions globally to all customers (using a global GPO) and then specific extensions to a sub-set of customers (using a local specific GPO).

 

Currently you appear to get a conflict message when trying to do this. It appears multiple extensions need to be defined in one GPO only, which isn't ideal for scenario above. Is it possible to get round this issue?

6 Replies
Highlighted

@JBrunsden Hi!  I'm checking with our Extension Team about your question.  We'll keep you updated if they have any suggestions.  Thanks! 

 

-Kelly

Highlighted

Hi @JBrunsden

 

Could you share the conflict error you are seeing?

 

Thanks

Ashish.  

Highlighted

Hi @ashishpoddar,

 

Below is the screenshot from the edge://policy/ screen.

 

JBrunsden_0-1601376629344.png

I did initially set this up with both exceptions defined in separate GPOs under Computer Config but same error as above even when one is defined in Computer and another in User (still separate GPOs).

 

Thanks,

 

John

 

 

Highlighted

Hi @ashishpoddar @Kelly_Y  any update on this?

Highlighted

Hi @JBrunsden

 

The suggestion here is to always apply the device policies after the user policies, so device will always win when there is a conflict between them.

 

Could you try this approach and confirm if this works?

 

Thanks

Ashish.

Highlighted

@ashishpoddar Hi, 

 

Unfortunately that just isn't possible with a current scenario, we enforce a Cyber GPO that pushes the ATP extension among other things, so this will always be above any user policies.

 

I think the issue here would ultimately be resolved if the  ExtensionInstallForcelist could just be populated with values from multiple GPOs, even in two separate Device GPOs one has to take precedence of the other and we cannot implement the way you described because of the reason above.

It looks like Chrome has GPOs that could work around this:

https://cloud.google.com/docs/chrome-enterprise/policies/?policy=PolicyDictionaryMultipleSourceMerge...

https://cloud.google.com/docs/chrome-enterprise/policies/?policy=PolicyListMultipleSourceMergeList

 

This presumably allows for separate values to be merged, so something like this could work in Edge?

 

For now we will probably have to look at putting all our extensions in one policy, but as initially stated, this isn't really flexible in an Enterprise environment for certain use cases.

 

Thanks