agentkeeper-managed-config.ps1

Intune · ADMX / OMA-URI · Windows

Deploy the AgentKeeper browser extension to Windows devices managed by Microsoft Intune. This path force-installs the extension on Chrome and delivers the managed config so the extension self-enrolls with no user interaction.

Prerequisites

• Microsoft Intune with device management for Windows
• Chrome deployed to managed devices
• An org API key from Settings → Access → API keys (starts with ak_live_)

The AgentKeeper Chrome extension ID is lllalmnahkbikalapoancgfkiegfoiim (shared by Chrome, Edge, Brave, and Arc). It is already filled into the templates below.

Step 1: Force-install the extension

1. Open the Microsoft Intune admin center.
2. Go to Devices → Configuration → Create → New Policy.
3. Platform: Windows 10 and later, Profile type: Administrative Templates (ADMX).
4. Search for ExtensionInstallForcelist under Chrome settings.
5. Enable the policy and add the entry:

lllalmnahkbikalapoancgfkiegfoiim;https://clients2.google.com/service/update2/crx

6. Assign the policy to your target device group.

Alternatively, use an OMA-URI custom policy:

Step 2: Deploy managed config

Do not put the managed config inside ExtensionSettings (e.g. an ExtensionSettings OMA-URI with a managed_configuration block). Chrome and Edge reject that with Schema validation error: Unknown property: managed_configuration and the extension never receives its configuration, so it stays "needs to connect". Chrome extension managed storage is a separate policy tree (3rdparty\extensions\<id>\policy), delivered below.

Chrome and Edge read extension managed config from the registry under the per-extension 3rdparty policy key. Intune does not expose that key through the Chrome ADMX, so deliver it with a PowerShell platform script (Devices → Scripts and remediations) that writes the registry values.

Machine-wide values: Run in system context (Run this script using the logged-on credentials: No):

$paths = @(
  "HKLM:\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\lllalmnahkbikalapoancgfkiegfoiim\policy",
  "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\lllalmnahkbikalapoancgfkiegfoiim\policy"
)
foreach ($p in $paths) {
  New-Item -Path $p -Force | Out-Null
  Set-ItemProperty -Path $p -Name "orgApiKey"  -Value "ak_live_xxxxxxxx"               -Type String
  Set-ItemProperty -Path $p -Name "backendUrl" -Value "https://www.agentkeeper.dev/api" -Type String
}

Replace ak_live_xxxxxxxx with your organization API key from Settings → Access → API keys. backendUrl is optional; the extension defaults to https://www.agentkeeper.dev/api; only set it (to your own host) for on-prem.

Per-user userEmail (required for attribution): The managed value is a literal, so Intune does not expand {{userPrincipalName}} inside a raw registry write (that token is only substituted in Intune App Configuration policies). Bind the user by writing the signed-in user's UPN at logon with a second script run using the logged-on credentials: Yes:

# agentkeeper-user-email.ps1
$userEmail = (whoami /upn) 2>$null
if (-not $userEmail) { $userEmail = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name }
foreach ($vendor in @("Google\Chrome", "Microsoft\Edge")) {
  $p = "HKCU:\SOFTWARE\Policies\$vendor\3rdparty\extensions\lllalmnahkbikalapoancgfkiegfoiim\policy"
  New-Item -Path $p -Force | Out-Null
  Set-ItemProperty -Path $p -Name "userEmail" -Value $userEmail -Type String
}

Do not skip this script. orgApiKey alone is enough for the extension to connect, but a device that enrolls without a userEmail stays unattributed and shows up as an anonymous workstation. Directory sync cannot recover it on its own: with no email (and no provider user id) on the captured events there is nothing to match the device against. Deploy both scripts to the same device group.

Step 3: Assign and sync

1. Assign the force-install policy and both managed-config scripts to the same device group.
2. Force a sync: Devices → select a device → Sync.
3. Policies and scripts apply within minutes; Chrome/Edge pick up the new policy on next launch.

Microsoft Edge

The scripts in Step 2 already write both the Chrome and Edge 3rdparty hives, and Edge installs Chrome Web Store extensions natively via the same ID. Add the Edge equivalent of the Step 1 force-install policy (ExtensionInstallForcelist under the Edge ADMX) to force-install it there too.

Verifying the rollout

On a managed Windows device:

1. Open chrome://policy (or edge://policy). Confirm ExtensionInstallForcelist shows the AgentKeeper entry, and that orgApiKey/userEmail appear under the 3rdparty section with no schema-validation warning. A warning like Unknown property: managed_configuration means the configuration was placed inside ExtensionSettings; move it to the 3rdparty registry tree from Step 2.
2. Open chrome://extensions. AgentKeeper shows "Installed by your administrator".
3. The extension popup reads "Paired" within seconds of first Chrome launch.

See Verifying deployment for the full checklist including dashboard confirmation.