Navigateurs enterprise¶

# Verify Chrome policies applied on the machine
reg query "HKLM\SOFTWARE\Policies\Google\Chrome" /s

# List all Chrome policy keys including sub-keys
Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Recurse | `
    ForEach-Object { Write-Output $_.PSPath }

# Verify Edge policies applied on the machine
reg query "HKLM\SOFTWARE\Policies\Microsoft\Edge" /s

# Compare Chrome and Edge policy counts
$chromeCount = (Get-ChildItem "HKLM:\SOFTWARE\Policies\Google\Chrome" -ErrorAction SilentlyContinue).Count
$edgeCount = (Get-ChildItem "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -ErrorAction SilentlyContinue).Count
Write-Output "Chrome policies sub-keys: $chromeCount"
Write-Output "Edge policies sub-keys: $edgeCount"

# Set homepage as mandatory policy (user cannot change it)
New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" `
    -Name "HomepageLocation" -Value "https://intranet.corp.local" -Type String
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" `
    -Name "HomepageIsNewTabPage" -Value 0 -Type DWord

# Set homepage as recommended policy (user can override)
New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\Recommended" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\Recommended" `
    -Name "HomepageLocation" -Value "https://intranet.corp.local" -Type String

# Force-install uBlock Origin on Chrome
$path = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name "1" `
    -Value "cjpalhdlnbpafiamejdnhcphjbkeiagm;https://clients2.google.com/service/update2/crx"

# Force-install uBlock Origin on Edge
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name "1" `
    -Value "odfafepnkmbhccpbejgmiehpchacaeak;https://edge.microsoft.com/extensionwebstorebase/v1/crx"

# Block all extensions by default on Chrome
$path = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist"
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name "1" -Value "*"

# Allow only specific extensions on Chrome (after blocking all with *)
$path = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist"
New-Item -Path $path -Force | Out-Null
# uBlock Origin
Set-ItemProperty -Path $path -Name "1" -Value "cjpalhdlnbpafiamejdnhcphjbkeiagm"
# Bitwarden
Set-ItemProperty -Path $path -Name "2" -Value "nngceckbapebfimnlniiiahkandclblb"

# Configure proxy via Chrome policy
$path = "HKLM:\SOFTWARE\Policies\Google\Chrome"
New-Item -Path $path -Force | Out-Null
# ProxyMode: fixed_servers, pac_script, auto_detect, system, direct
Set-ItemProperty -Path $path -Name "ProxyMode" -Value "fixed_servers" -Type String
Set-ItemProperty -Path $path -Name "ProxyServer" -Value "proxy.corp.local:8080" -Type String
Set-ItemProperty -Path $path -Name "ProxyBypassList" `
    -Value "*.corp.local;*.internal.net;localhost;127.0.0.1" -Type String

# Configure proxy via PAC file on Edge
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name "ProxyMode" -Value "pac_script" -Type String
Set-ItemProperty -Path $path -Name "ProxyPacUrl" `
    -Value "https://proxy.corp.local/proxy.pac" -Type String

# Configure homepage and show Home button on Chrome
$path = "HKLM:\SOFTWARE\Policies\Google\Chrome"
Set-ItemProperty -Path $path -Name "HomepageLocation" `
    -Value "https://intranet.corp.local" -Type String
Set-ItemProperty -Path $path -Name "HomepageIsNewTabPage" -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name "ShowHomeButton" -Value 1 -Type DWord

# Force default search engine on Chrome
$path = "HKLM:\SOFTWARE\Policies\Google\Chrome"
Set-ItemProperty -Path $path -Name "DefaultSearchProviderEnabled" -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name "DefaultSearchProviderName" `
    -Value "Google" -Type String
Set-ItemProperty -Path $path -Name "DefaultSearchProviderSearchURL" `
    -Value "https://www.google.com/search?q={searchTerms}" -Type String
Set-ItemProperty -Path $path -Name "DefaultSearchProviderKeyword" `
    -Value "google.com" -Type String

# Open specific URLs at startup on Chrome
$path = "HKLM:\SOFTWARE\Policies\Google\Chrome"
Set-ItemProperty -Path $path -Name "RestoreOnStartup" -Value 4 -Type DWord

$urlPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\RestoreOnStartupURLs"
New-Item -Path $urlPath -Force | Out-Null
Set-ItemProperty -Path $urlPath -Name "1" `
    -Value "https://intranet.corp.local" -Type String
Set-ItemProperty -Path $urlPath -Name "2" `
    -Value "https://mail.corp.local" -Type String

# Disable Chrome Sync entirely
$path = "HKLM:\SOFTWARE\Policies\Google\Chrome"
Set-ItemProperty -Path $path -Name "SyncDisabled" -Value 1 -Type DWord

# Disable the built-in password manager
Set-ItemProperty -Path $path -Name "PasswordManagerEnabled" -Value 0 -Type DWord

# Disable saving passwords
Set-ItemProperty -Path $path -Name "PasswordManagerOnboarding" -Value 0 -Type DWord

# Disable Edge Sync
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
Set-ItemProperty -Path $path -Name "SyncDisabled" -Value 1 -Type DWord

# Disable password manager
Set-ItemProperty -Path $path -Name "PasswordManagerEnabled" -Value 0 -Type DWord

# Block sign-in with personal Microsoft accounts
Set-ItemProperty -Path $path -Name "BrowserSignin" -Value 0 -Type DWord

# Disable autofill for sensitive data on both browsers
foreach ($browser in @("Google\Chrome", "Microsoft\Edge")) {
    $path = "HKLM:\SOFTWARE\Policies\$browser"
    New-Item -Path $path -Force | Out-Null
    Set-ItemProperty -Path $path -Name "AutofillAddressEnabled" -Value 0 -Type DWord
    Set-ItemProperty -Path $path -Name "AutofillCreditCardEnabled" -Value 0 -Type DWord
}

# Check if Chrome ADMX templates are installed
Test-Path "C:\Windows\PolicyDefinitions\chrome.admx"

# Check if Edge ADMX templates are installed
Test-Path "C:\Windows\PolicyDefinitions\msedge.admx"

# Deploy browser extension policies for Chrome and Edge
# Target: all workstations in the fleet

$chromeBase = "HKLM:\SOFTWARE\Policies\Google\Chrome"
$edgeBase = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"

# Security extension IDs (replace with your actual IDs)
$securityExtChrome = "exampleidchrome123456789012345678"
$securityExtEdge = "exampleidedge12345678901234567890"

# Approved extensions: uBlock Origin, Bitwarden, corporate security
$approvedChrome = @(
    "cjpalhdlnbpafiamejdnhcphjbkeiagm",   # uBlock Origin
    "nngceckbapebfimnlniiiahkandclblb",     # Bitwarden
    $securityExtChrome                       # Corporate security extension
)

$approvedEdge = @(
    "odfafepnkmbhccpbejgmiehpchacaeak",    # uBlock Origin
    "jbkfoedolllekgbhcbcoahefnbanhhlh",     # Bitwarden
    $securityExtEdge                         # Corporate security extension
)

foreach ($base in @($chromeBase, $edgeBase)) {
    # Create base key
    New-Item -Path $base -Force | Out-Null

    # Step 1: block all extensions
    $blockPath = "$base\ExtensionInstallBlocklist"
    New-Item -Path $blockPath -Force | Out-Null
    Set-ItemProperty -Path $blockPath -Name "1" -Value "*"
}

# Step 2: set allowlist for Chrome
$allowPath = "$chromeBase\ExtensionInstallAllowlist"
New-Item -Path $allowPath -Force | Out-Null
for ($i = 0; $i -lt $approvedChrome.Count; $i++) {
    Set-ItemProperty -Path $allowPath -Name ($i + 1).ToString() -Value $approvedChrome[$i]
}

# Step 2: set allowlist for Edge
$allowPath = "$edgeBase\ExtensionInstallAllowlist"
New-Item -Path $allowPath -Force | Out-Null
for ($i = 0; $i -lt $approvedEdge.Count; $i++) {
    Set-ItemProperty -Path $allowPath -Name ($i + 1).ToString() -Value $approvedEdge[$i]
}

# Step 3: force-install security extension on Chrome
$forcePath = "$chromeBase\ExtensionInstallForcelist"
New-Item -Path $forcePath -Force | Out-Null
Set-ItemProperty -Path $forcePath -Name "1" `
    -Value "$securityExtChrome;https://clients2.google.com/service/update2/crx"

# Step 3: force-install security extension on Edge
$forcePath = "$edgeBase\ExtensionInstallForcelist"
New-Item -Path $forcePath -Force | Out-Null
Set-ItemProperty -Path $forcePath -Name "1" `
    -Value "$securityExtEdge;https://edge.microsoft.com/extensionwebstorebase/v1/crx"

Write-Output "Browser extension policies applied successfully."

# Verify Chrome extension policies
Write-Output "=== Chrome Blocklist ==="
reg query "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist"
Write-Output "`n=== Chrome Allowlist ==="
reg query "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist"
Write-Output "`n=== Chrome Forcelist ==="
reg query "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"

# Force immediate GPO refresh on target machines (run from admin workstation)
Invoke-Command -ComputerName (Get-Content "C:\Admin\workstations.txt") -ScriptBlock {
    gpupdate /force /target:computer
}