Skip to main content
Revised June 2026 — Active Directory GPO distribution only

​
Setup Summary (Fastest Path)

With a single GPO, configure the following three locations. See Chapter 3 for details.
#GPO pathConfiguration
1Computer Configuration → Preferences → Windows Settings → RegistryRegister each Chrome / Edge ExtensionSettings (force_installed + update_url) in HKLM
2User Configuration → Preferences → Windows Settings → RegistryRegister each Chrome / Edge 3rdparty/policy (ApiKey, OrganizationID, etc. + UserEmail=%USEREMAIL%) in HKCU
3User Configuration → Policies → Windows Settings → Scripts → LogonRegister Set-UserEmailEnv.bat from SYSVOL (for the USEREMAIL environment variable)
Verification after applying (fastest):
  1. Link the GPO to the target OU → gpupdate /force or sign in again
  2. Run check_extension_registry.bat (HKLM=ExtensionSettings / HKCU=policy show [OK])
  3. Reload chrome://policy / edge://policy in the browser → check the values on the extension options page (refresh with ↻ if not reflected)
Obtain ApiKey / CreatedDate / OrganizationID from the admin console. The Logon Script is not needed if you specify UserEmail directly.

​
Chapter 1: Overview

​
Purpose

This document is a setup guide for mass-distributing the browser extension via Active Directory GPO (Group Policy). It focuses on distribution using GPMC Registry Preferences and a logon script.

​
Intended Audience

IT administrators (Active Directory administrators) and information systems staff.

​
Prerequisites

ItemDetails
OSWindows 10 or later
BrowserGoogle Chrome or Microsoft Edge installed
DomainActive Directory domain environment
PermissionsPermission to create/edit GPOs and place scripts in SYSVOL
Allow the following destinations.
DestinationPortPurpose
clients2.google.com443 (HTTPS)Download / update Chrome extensions
edge.microsoft.com443 (HTTPS)Download / update Edge extensions
api.itmc.i.moneyforward.com443 (HTTPS)Data transmission / API access
itmc.i.moneyforward.com443 (HTTPS)Web access

​
Extension ID

BrowserEnvironmentExtension ID
Google ChromePRODbdeanmdeckegmfjpbnngomallcedjold
Microsoft EdgePRODflggmhlpipcopffjfkpgkoljghfkmfcg

​
Bundled Files

FilePurpose
Set-UserEmailEnv.batLogon script. Sets the USEREMAIL environment variable
edge_chrome_extension.batAlternative: startup script method (see 3.7)
edge_chrome_extension_uninstall.batComplete removal of registry keys and environment variables (Chapter 7)
check_extension_registry.batRegistry check (read-only)

​
Chapter 2: Overall Configuration

The setup consists of two layers: the registry (GPO Preferences) and a user environment variable (logon script).
LayerGPO placementRegistryContents
Forced installComputer ConfigurationHKLMExtensionSettings (installation_mode, update_url)
Extension parametersUser ConfigurationHKCU3rdparty/extensions/<ID>/policy
Email addressUser Configuration—Logon Script → USEREMAIL environment variable
Computer Configuration → HKLM
ExtensionSettings\<ID>
  installation_mode = force_installed
  update_url        = https://...

User Configuration → HKCU
3rdparty\extensions\<ID>\policy
  ApiKey, CreatedDate, OrganizationID
  UserEmail = %USEREMAIL%
  UserPC    = %COMPUTERNAME%

User Configuration → Logon Script
Set-UserEmailEnv.bat → USEREMAIL = user@example.com

​
Chapter 3: GPO Setup Steps

​
GPO Editor Terminology (English UI / Japanese UI)

This document uses the English (Japanese) format. Follow the corresponding item based on your GPMC display language.
English (GPMC English UI)Japanese (GPMC Japanese UI)
Computer Configurationコンピューターの構成
User Configurationユーザーの構成
Preferences基本設定
Policiesポリシー
Windows SettingsWindows の設定
Registryレジストリ
Scripts (Logon/Logoff)スクリプト（ログオン/ログオフ）
Logonログオン
Startupスタートアップ
Action操作
Update更新
Delete削除
How to read a GPO path: follow the GPO editor tree from left to right, as in Computer Configuration → Preferences → …

​
3.1 Obtaining Values from the Admin Console

Sign in, open Settings > Organization > Browser Extension > Extension Policy, and note the three values ApiKey, CreatedDate, and OrganizationID (fixed values common to all devices).

​
3.2 Creating the GPO

  1. Open GPMC and create a new GPO linked to the target OU (for example, Admina Extension).
  2. Link it to a verification OU first, then roll it out to the production OU once confirmed.
From here, configure both Computer Configuration and User Configuration within the same GPO.

​
3.3 Computer Configuration — ExtensionSettings (HKLM)

GPO path: Computer Configuration → Preferences → Windows Settings → Registry Common settings: Hive = HKEY_LOCAL_MACHINE, Action = Update Registry list under Computer Configuration

​
3.3.1 Chrome — ExtensionSettings

Key Path: Software\Policies\Google\Chrome\ExtensionSettings\bdeanmdeckegmfjpbnngomallcedjold
Value nameValue typeValue data
installation_modeREG_SZforce_installed
update_urlREG_SZhttps://clients2.google.com/service/update2/crx
Example of the Chrome installation_mode setting Example of the Chrome update_url setting

​
3.3.2 Edge — ExtensionSettings

Key Path: Software\Policies\Microsoft\Edge\ExtensionSettings\flggmhlpipcopffjfkpgkoljghfkmfcg
Value nameValue typeValue data
installation_modeREG_SZforce_installed
update_urlREG_SZhttps://edge.microsoft.com/extensionwebstorebase/v1/crx
Writing ExtensionSettings in both HKLM and HKCU causes a conflict and one side is ignored (see Note 3). Always place it only in Computer Configuration (HKLM).

​
3.4 User Configuration — 3rdparty/policy (HKCU)

GPO path: User Configuration → Preferences → Windows Settings → Registry Common settings: Hive = HKEY_CURRENT_USER, Action = Update Registry list under User Configuration

​
3.4.1 Chrome — 3rdparty/policy

Key Path: Software\Policies\Google\Chrome\3rdparty\extensions\bdeanmdeckegmfjpbnngomallcedjold\policy
Value nameValue typeValue data
ApiKeyREG_SZValue obtained from the admin console
CreatedDateREG_SZValue obtained from the admin console (e.g., 2024-07-04T01:11:27.000Z)
OrganizationIDREG_SZValue obtained from the admin console
UserEmailREG_EXPAND_SZ%USEREMAIL%
UserPCREG_EXPAND_SZ%COMPUTERNAME%
Example of the ApiKey setting Example of the CreatedDate setting Example of the OrganizationID setting Example of the UserEmail setting Example of the UserPC setting

​
3.4.2 Edge — 3rdparty/policy

Key Path: Software\Policies\Microsoft\Edge\3rdparty\extensions\flggmhlpipcopffjfkpgkoljghfkmfcg\policy Create the same five items as Chrome (Value name / Value type / Value data are identical) under the Edge Key Path. Do not also write 3rdparty/policy under Computer Configuration (HKLM) (see Note 4).

​
3.5 Logon Script — USEREMAIL Environment Variable

If you distribute UserEmail as a %USEREMAIL% reference, you need a logon script that sets the USEREMAIL environment variable at each user’s logon (see Note 5). GPO path: User Configuration → Policies → Windows Settings → Scripts (Logon/Logoff) → Logon
ItemValue
Script\\<DOMAIN>\SYSVOL\<DOMAIN>\scripts\admina\Set-UserEmailEnv.bat
Parameters(empty)
Steps:
  1. Edit the DomainPart in Set-UserEmailEnv.bat to your company domain (e.g., example.com).
  2. Place it in scripts\admina\ under SYSVOL.
  3. Register it as a Logon script using the GPO path above.
Example of registering the logon script If you specify the email address directly in UserEmail, the logon script is not needed.

​
3.6 Applying the GPO

  1. Link the GPO to the target OU.
  2. Run gpupdate /force on a verification device, or sign in again.
  3. Run check_extension_registry.bat using the steps in Chapter 4.

​
3.7 Alternative: Startup Script Method

Instead of Registry Preferences, you can place edge_chrome_extension.bat in SYSVOL and register it as a Startup script using the following GPO path. Computer Configuration → Policies → Windows Settings → Scripts → Startup Edit the constants in the bat file.
VariableRecommended value
ApiKey / CreatedDate / OrganizationIDObtained from the admin console
ExtSettingsRootHKLM
PolicyRootHKCU
UserEmailModeENV_REF
The USEREMAIL setting via the logon script (3.5) is still required.

​
Chapter 4: Verifying Operation

​
4.1 Verification via the Check Script

Run check_extension_registry.bat as the target user (read-only). Criteria for a normal result:
Check itemExpected result
User EnvironmentUSEREMAIL: defined, with the user’s email address as the value
HKCU — ExtensionSettingsAll [—] NOT SET (intentionally not placed)
HKCU — 3rdparty PolicyAll five items [OK]
HKLM — ExtensionSettingsTwo items (installation_mode, update_url) are [OK]
HKLM — 3rdparty PolicyAll [—] NOT SET (intentionally not placed)
The Summary’s 14 found / 14 missing is normal because both HKCU and HKLM are scanned. The [—] for “intentionally not placed” is not an error. Example output (verification environment): 
================================================================
Extension Registry Checker  (read-only)
Date: 2026/06/09 16:26:51.46
================================================================

[User Environment]
USEREMAIL: defined
Value   : user@example.com

----------------------------------------
HKCU  (HKEY_CURRENT_USER)
----------------------------------------

[Chrome 3rdparty Policy]
Key: HKEY_CURRENT_USER\Software\Policies\Google\Chrome\3rdparty\extensions\bdeanmdeckegmfjpbnngomallcedjold\policy
[OK] ApiKey = eyJhbGciOiJIUzI1NiIs...
[OK] CreatedDate = 2024-07-04T01:11:27.000Z
[OK] OrganizationID = 99999999
[OK] UserEmail = user@example.com
[OK] UserPc = EXAMPLE-PC

----------------------------------------
HKLM  (HKEY_LOCAL_MACHINE)
----------------------------------------

[Chrome ExtensionSettings]
Key: HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionSettings\bdeanmdeckegmfjpbnngomallcedjold
[OK] installation_mode = force_installed
[OK] update_url        = https://clients2.google.com/service/update2/crx

================================================================
Summary:  14 found  /  14 missing
================================================================
The GPO registers the Value name as UserPC, but the check script references it as UserPc. If the actual registry value shows [OK], there is no problem.

​
4.2 Verifying Installation in the Browser

Even if the registry settings are correct, there is a delay before they are reflected in the browser.
TimingDetails
Extension downloadAfter the GPO is applied, it may take time to fetch the extension itself from the store
Policy loadingThere is a delay before the browser re-fetches the policy in the background
To check immediately, perform the following two steps in order.
  1. Explicitly reload the policy page (4.2.1)
  2. Open the extension options page and press refresh (↻) if not reflected (4.2.2)

​
4.2.1 Explicitly Reloading the Policy

Chrome
  1. Enter chrome://policy in the address bar and open it.
  2. Click Reload policies.
  3. Confirm that each value (ApiKey, OrganizationID, UserEmail, etc.) appears with OK under Extension policies at the bottom.
Reloading policies on Chrome's chrome://policy Edge
  1. Enter edge://policy in the address bar and open it.
  2. Click Reload policies.
Reloading policies on Edge's edge://policy The 3rdparty/policy section does not appear on Edge’s edge://policy (known behavior). Reload the policy anyway, and verify the values on the options page in 4.2.2 (see Note 7).

​
4.2.2 Verifying on the Extension Options Page

Chrome
  1. Toolbar extension icon → the extension’s ︙ (More) → open Options.
  2. Confirm that “Installed by your administrator” appears in the extension menu.
  3. On the options page, confirm the following.
    • The email address has a Managed tag and a value
    • The organization ID has the value from the admin console
    • No error appears at the top of the screen
  4. If a value is still empty, press refresh (↻) once at the bottom right of the page.
Verifying on the Chrome extension options page Edge
  1. Toolbar extension icon → the extension’s ︙ (More) → open Extension options.
  2. As with Chrome, confirm the email address (Managed), organization ID, and no errors.
  3. If not reflected, press refresh (↻) once at the bottom right of the page.
Verifying on the Edge extension options page

​
4.2.3 Verifying in the Extensions List (Reference)

  • Chrome: chrome://extensions
  • Edge: edge://extensions
If the extension shows “Installed by your organization” (Chrome) / “Installed by your administrator” (Edge), the forced installation itself has succeeded.

​
4.3 Diag Data (For Investigation)

You can obtain investigation logs from Diagnostic Data at the bottom right of the options page. If there is no connectivity, see Chapter 5.

​
Chapter 5: Connectivity and Data Verification

​
5.1 Data Arrival Verification

Within about 30 minutes, entries from the Chrome / Edge source appear under “Integrations > Event Log”.

​
5.2 When There Is No Connectivity

Check for warnings via the extension icon → Settings (⚙️). For details, see How to review Diag data.

​
5.3 Network Verification

Test-NetConnection -ComputerName api.itmc.i.moneyforward.com -Port 443

​
Chapter 6: Technical Notes

​
Note 1: ExtensionSettings = HKLM, 3rdparty/policy = HKCU

ExtensionSettings is a per-machine setting. Because the UserEmail in 3rdparty/policy differs per user, it is placed in User Configuration (HKCU).

​
Note 2: Action = Update

Creates the entry if it does not exist and overwrites it if it does. Replace re-creates the entire key and has side effects.

​
Note 3: ExtensionSettings HKLM/HKCU Conflict

If it exists in both HKLM and HKCU, only the HKLM side is used.

​
Note 4: 3rdparty/policy HKLM/HKCU Conflict

If the same value name exists in both, HKLM takes precedence.

​
Note 5: Why UserEmail Uses an Environment Variable Reference

When Computer Configuration is applied, USEREMAIL is not expanded because it runs in the SYSTEM context. The combination of User Configuration and a logon script is required.

​
Note 6: Permissions for HKCU\Software\Policies

Only GPO Preferences (User Configuration) can write to HKCU\Software\Policies. A logon script can only set the USEREMAIL environment variable.

​
Note 7: 3rdparty/policy Not Shown on edge://policy

The values themselves reach the extension. See Appendix A.2.

​
Chapter 7: Uninstalling

Removing items from the GPO alone leaves the registry values on the device (the GPP “tattoo” effect).
PlacementHiveKey PathAction
Computer ConfigurationHKEY_LOCAL_MACHINESoftware\Policies\Google\Chrome\ExtensionSettings\bdeanmdeckegmfjpbnngomallcedjoldDelete
Computer ConfigurationHKEY_LOCAL_MACHINESoftware\Policies\Microsoft\Edge\ExtensionSettings\flggmhlpipcopffjfkpgkoljghfkmfcgDelete
User ConfigurationHKEY_CURRENT_USERSoftware\Policies\Google\Chrome\3rdparty\extensions\bdeanmdeckegmfjpbnngomallcedjoldDelete
User ConfigurationHKEY_CURRENT_USERSoftware\Policies\Microsoft\Edge\3rdparty\extensions\flggmhlpipcopffjfkpgkoljghfkmfcgDelete
Also remove the logon script from the GPO.

​
7.2 Method B: Uninstall bat

Run edge_chrome_extension_uninstall.bat with administrator privileges. It removes both the HKLM / HKCU keys and the USEREMAIL environment variable. After running it, reload the policy at chrome://policy / edge://policy.

​
Appendix A: Verifying Policies in the Browser

For detailed steps and screenshots, see Section 4.2.

​
A.1 Chrome: chrome://policy

After “Reload policies”, you can check the Scope (Machine / User) and each value’s Status (OK) in the Extension policies section.

​
A.2 Edge: Verifying 3rdparty/policy

3rdparty/policy is not shown on edge://policy. Verify it on the options page in 4.2.2, or as follows.
  • Method 1: Check the HKCU values with check_extension_registry.bat.
  • Method 2: In the Service Worker console (edge://extensions → Developer mode → Inspect Service Worker), run chrome.storage.managed.get(null, (data) => console.log(data)).

​
Appendix B: Q&A

​
Q. Does the extension disappear just by unlinking the GPO?

A. No. Remove it explicitly using the Delete action in Chapter 7 or edge_chrome_extension_uninstall.bat.

​
Q. The check script shows “Some values are missing”.

A. In the recommended GPO configuration, it is normal for the HKCU-side ExtensionSettings and the HKLM-side 3rdparty/policy to show [—] (see Section 4.1).

​
Q. The registry is OK but the extension does not appear in the browser.

A. There is a delay in downloading the extension and loading the policy. Try the steps in Section 4.2 (reload the policy → refresh ↻ on the options page).

​
Q. What if whoami /upn is not available in the environment?

A. Set the DomainPart in Set-UserEmailEnv.bat correctly.

​
Q. What if SKYSEA or similar uses ExtensionSettings?

A. Because the extension IDs differ, they can coexist at the subkey level. Align the source hive (HKLM / HKCU) with your asset management software.
Last modified on July 6, 2026