Group Policy

[CarlGreenApps]

I see that TGS now supports Group Policy according to the readme page here but doesn't tell you how to use it. Can you advise if there is an ADMX file to download?

[deanoemcke]

The code was submitted by @marcospgp
I would also like a little more info on how to go about implementing group policy.

[CAPA14]

Hello!
Still no words about this?

This is a MUST because I need to implement this in VDI environments where a centralized management for all users is the ideal!
Imagine that I will deploy to 400 users and then we need to set some site to the White List... Informing the users to configure it will not work very well... so a GPO will be fantastic.

If not a GPO where the settings of the Great Suspender are stored? Would it be possible to copy the configuration file or registry keys from one users to another?

[marcospgp]

The settings described in the readme should be set directly as registry values through the group policy.

When developing that feature I edited my computer's registry directly to test the effects.

https://theitbros.com/add-modify-and-delete-registry-keys-using-group-policy/

[CarlGreenApps]

@marospgp, thanks for coming back to us but the answer is to vague. What is the starting point of the registry setting, ie.

HKCU\SOFTWARE\Google\Chrome\Extensions\klbibkeccnjlkjkiokjodocebajanakg
Multipart String named WHITELIST

WHITELIST contains per line sites to whitelist, ie:
www.bbc.co.uk
www.google.co.uk

I tried above on my pc but my whitelist remained the same.

What is the TAG version that includes support for GPO usage? I have v7.1.6

[marcospgp]

Forgive me, it's been a while since I last looked at this.

You need to follow Chrome's instructions on setting group policy values for browser extensions: Check this https://support.google.com/chrome/a/answer/7532015?hl=en or this https://support.google.com/chrome/a/answer/7532015?hl=en for example

[CAPA14]

Thanks for answering.

I'm looking at this https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionSettings

Which actually points template and to the following registry key:
Software\Policies\Google\Chrome\Recommended\ExtensionSettings

However this looks like just extensions permissions and where it's allowed to run and not "in extension" settings.
I'm confused :)

[CarlGreenApps]

@marcospgp can you share a example json string which I can enter into the GPO setting named Extension management settings

[Simkonge]

Has anyone implemented this in a RDP environment?
We're looking into deploy TGS on our terminal servers, and I'd love to hear if anyones done it yet.

[jcrossplaza]

I've tried adding json to ExtensionSettings in many different formats, but none of the code I use works because ExtensionSettings seems to apply only to settings outside of the extensions (like permissions, whitelists and install locations). I cannot, for example, get the json to adjust actual in-app settings. See example json code below (note I have tried this code in MANY different variations, the best I can get is for it to tell me that the parameter isn't valid).
{"klbibkeccnjlkjkiokjodocebajanakg":{"UNSUSPEND_ON_FOCUS": ["true"]}}
Error: Schema validation error at "klbibkeccnjlkjkiokjodocebajanakg": Unknown property: UNSUSPEND_ON_FOCUS

To help others figure this out:
{"this is the extensions ID":{"this is the extension's parameter": ["this is the setting"]}}

Here are some useful links:
https://support.google.com/chrome/a/answer/7532015?hl=en
https://mythic-byway-180716.appspot.com/

[CAPA14]

I've tried adding json to ExtensionSettings in many different formats, but none of the code I use works because ExtensionSettings seems to apply only to settings outside of the extensions (like permissions, whitelists and install locations). I cannot, for example, get the json to adjust actual in-app settings. See example json code below (note I have tried this code in MANY different variations, the best I can get is for it to tell me that the parameter isn't valid).
{"klbibkeccnjlkjkiokjodocebajanakg":{"UNSUSPEND_ON_FOCUS": ["true"]}}
Error: Schema validation error at "klbibkeccnjlkjkiokjodocebajanakg": Unknown property: UNSUSPEND_ON_FOCUS

To help others figure this out:
{"this is the extensions ID":{"this is the extension's parameter": ["this is the setting"]}}

Here are some useful links:
https://support.google.com/chrome/a/answer/7532015?hl=en
https://mythic-byway-180716.appspot.com/

Yeah as I suspected, these GPO settings are just Settings for the Extensions access permissions and urls allowed to run it.
Does not apply to settings inside the Extension itself.

@marcospgp we need accurate examples of how to use the parameters, please.
Exs:
Change the following Registry Key (provide the registry key path and value)
Change the following File ( provide the file path and lines to change/add)

[CarlGreenApps]

@marcospgp any progress been made on advising us what registry keys we need to use?

[CarlGreenApps]

@deanoemcke is there an option to use a command URL to update settings?
for example:
chrome-extension://klbibkeccnjlkjkiokjodocebajanakg/options.html?WHITELIST=website1.com,website2.com&SCREEN_CAPTURE=0&SCREEN_CAPTURE_FORCE=TRUE ...

I could then put this into shortcut for user and on opening Chrome the settings are updated?
..\chrome.exe chrome-extension://klbibkeccnjlkjkiokjodocebajanakg/options.html?WHITELIST=website1.com,website2.com&SCREEN_CAPTURE=0&SCREEN_CAPTURE_FORCE=TRUE ... etc etc..

[JonathanPitre]

Here's a working GPO synthax, works fine for all reg keys except the WHITELIST one.

[marcospgp]

@JonathanPitre try surrounding the items in the whitelist with quotes and separating multiple items with a comma, such as "google.com","youtube.com".

Also apologies for the lack of info, but it's been a long time since I was hired to work on this and I don't remember most of the details. Should have done a better job with documentation!

[JonathanPitre]

Hi @marcospgp I have already tried with "google.com" and I still don't see the URL in the whitelist.

Also can you tell us if this would work for Microsoft Edge as well ? I have tried this reg key and it does not do anything.

HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\klbibkeccnjlkjkiokjodocebajanakg\policy
SUSPEND_TIME