GPO Blocking of Edge Extensions

[Skylark56]

So about a month ago we all moved over from Chrome to MS Edge as a default browser which in turn allowed us to block edge extensions through a GPO, this appeared to have worked for roughly a month and now regardless of how I change the GPO, it refuses to block any Edge Extensions.

 

Has anybody else had the same issue, or found an alternative to stopping students from installing Edge Extensions (its mainly to stop students using VPN extensions)

 

Thanks.

[CHiLL]

We have the following policy settings in place in: User Configuration > Policies > Administrative Templates > Microsoft Edge > Extensions

 

Name: Allow specific extensions to be installed

Setting: Enabled

Extension IDs to exempt from the block list: efaidnbmnnnibpcajpcglclefindmkaj;https://clients2.google.com/service/update2/crx

 

Name: Control which extensions are installed silently

Setting: Enabled

Extension/App IDs and update URLs to be silently installed: pdmhilamamchgnnipghbjakjpbenbcdj;https://clients2.google.com/service/update2/crx

 

Name: Control which extensions cannot be installed

Setting: Enabled

Extension IDs the user should be prevented from installing (or * for all): *

 

The combination of those settings will block all extensions from installing, except those specified as exemptions (Impero is the extension specified above for us). If it's still not applying, try gpresult to see if the policy is being applied.

[Skylark56]

We have the following policy settings in place in: User Configuration > Policies > Administrative Templates > Microsoft Edge > Extensions

 

Name: Allow specific extensions to be installed

Setting: Enabled

Extension IDs to exempt from the block list: efaidnbmnnnibpcajpcglclefindmkaj;https://clients2.google.com/service/update2/crx

 

Name: Control which extensions are installed silently

Setting: Enabled

Extension/App IDs and update URLs to be silently installed: pdmhilamamchgnnipghbjakjpbenbcdj;https://clients2.google.com/service/update2/crx

 

Name: Control which extensions cannot be installed

Setting: Enabled

Extension IDs the user should be prevented from installing (or * for all): *

 

The combination of those settings will block all extensions from installing, except those specified as exemptions (Impero is the extension specified above for us). If it's still not applying, try gpresult to see if the policy is being applied.

 

 

 

We have these settings almost identical to yourself (minus Impero) but yet students are still allowed to install extensions....I did GPResult too and it shows the policy has applied. In a bit of a rock and a hard place now as students are actively trying to bypass our filtering.

[mrbios]

Try setting the same settings under Computer configuration rather than user configuration. I've found Edge doesn't seem to respond as well to these settings per-user as it does per-machine.

[Skylark56]

Try setting the same settings under Computer configuration rather than user configuration. I've found Edge doesn't seem to respond as well to these settings per-user as it does per-machine.

 

Tried this also and the same issue applies...I seem to remember some forum posts a while ago mentioning that certain Edge updates break group policy, perhaps this latest update does the same?

[CHiLL]

Tried this also and the same issue applies...I seem to remember some forum posts a while ago mentioning that certain Edge updates break group policy, perhaps this latest update does the same?

You do have to keep replacing the Edge ADMX templates from time to time, as with Chrome. They will add, move or depreciate features so they need re-doing sometimes.

[BlueScreen]

Have you tried to visit edge://policy to see if there are any warnings?

[Skylark56]

Have you tried to visit edge://policy to see if there are any warnings?

 

Yeah oddly, there are no conflicts or warnings.

[Planehazza]

Thread necro, but getting same issues. Kids installing VPNs. W11 is awful to manage. Can't get AppLocker to block Edge, and GPResult and edge://policy show the GPOs blocking extensions being applied, and yet extensions are installing. 

[Skylark56]

22 minutes ago, Planehazza said:

Thread necro, but getting same issues. Kids installing VPNs. W11 is awful to manage. Can't get AppLocker to block Edge, and GPResult and edge://policy show the GPOs blocking extensions being applied, and yet extensions are installing. 

Are you blocking from a system level on GP or a user level? I believe we had done it at system level, but you want to be blocking the user level. I don't think you can block them if they are already installed however. It may be a case of catching students in the act and uninstalling them?

[Planehazza]

Just now, Skylark56 said:

Are you blocking from a system level on GP or a user level? I believe we had done it at system level, but you want to be blocking the user level. I don't think you can block them if they are already installed however. It may be a case of catching students in the act and uninstalling them?

Tried both. Can't tackle it retrospectively; every student and their dog will try once the knowledge spreads. We must get Edge blocked or extensions blocked at the very least.

 

Thankfully our Meraki is stopping access to most dangerous things, but VPNs are a major risk if they can be installed as an extension