GPO login script: Set-AgentKeeperUserEmail.ps1

Active Directory · ADMX · Registry

Deploy the AgentKeeper browser extension to Windows devices using Group Policy (GPO). This path works for on-prem Active Directory environments and is also compatible with Intune-synced hybrid AD setups.

Prerequisites

• Active Directory with Group Policy management (GPMC)
• Chrome ADMX templates installed in your domain (download from Google)
• An org API key from Settings → Access → API keys (starts with ak_live_)

The AgentKeeper Chrome extension ID is lllalmnahkbikalapoancgfkiegfoiim (shared by Chrome, Edge, Brave, and Arc). It is already filled into the templates below.

Step 1: Install Chrome ADMX templates

If not already installed, download and copy the Chrome ADMX files to your domain's Central Store:

\\DOMAIN\SYSVOL\DOMAIN\Policies\PolicyDefinitions\chrome.admx
\\DOMAIN\SYSVOL\DOMAIN\Policies\PolicyDefinitions\en-US\chrome.adml

Step 2: Create the extension GPO

1. Open Group Policy Management Console (GPMC).
2. Create a new GPO (e.g., AgentKeeper Browser Extension).
3. Navigate to: Computer Configuration → Policies → Administrative Templates → Google → Google Chrome → Extensions.
4. Enable Configure the list of force-installed extensions and add:

lllalmnahkbikalapoancgfkiegfoiim;https://clients2.google.com/service/update2/crx

Step 3: Deploy managed config via registry

Group Policy does not natively support Chrome's managed storage policy. Deliver it via a registry .reg file pushed through a GPO Startup Script or login script:

Save as agentkeeper-managed-config.reg:

Windows Registry Editor Version 5.00

; Force-install AgentKeeper
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"1"="lllalmnahkbikalapoancgfkiegfoiim;https://clients2.google.com/service/update2/crx"

; Managed config (org API key + user binding)
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\lllalmnahkbikalapoancgfkiegfoiim\policy]
"orgApiKey"="ak_live_xxxxxxxx"
"backendUrl"="https://www.agentkeeper.dev/api"

Note on userEmail: Registry policy values do not support environment variable expansion directly. To inject the user's UPN, use a login script (PowerShell) that writes the registry value at login time:

$userEmail = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
$regPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\lllalmnahkbikalapoancgfkiegfoiim\policy"
Set-ItemProperty -Path $regPath -Name "userEmail" -Value $userEmail -Type String

Add this script under User Configuration → Windows Settings → Scripts → Logon.

Step 4: Link and apply

1. Link the GPO to the OU containing your target machines.
2. Run gpupdate /force on a test machine to apply immediately.
3. Chrome picks up the policy on next launch.

Microsoft Edge

Duplicate the registry entries under the Edge hive:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist]
"1"="lllalmnahkbikalapoancgfkiegfoiim;https://clients2.google.com/service/update2/crx"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\lllalmnahkbikalapoancgfkiegfoiim\policy]
"orgApiKey"="ak_live_xxxxxxxx"
"backendUrl"="https://www.agentkeeper.dev/api"

Verifying the rollout

On a managed Windows device after gpupdate /force and a Chrome restart:

1. Open chrome://policy; ExtensionInstallForcelist should show the AgentKeeper entry.
2. Open chrome://extensions; AgentKeeper should show "Installed by your administrator".
3. Extension popup reads "Paired".

See Verifying deployment for the full checklist.