> ## Documentation Index > Fetch the complete documentation index at: https://support.i.moneyforward.com/llms.txt > Use this file to discover all available pages before exploring further. # 2-4. Browser Extension Setup Guide (Windows GPO) > A setup guide for mass-distributing the browser extension via Active Directory GPO (Group Policy). Revised June 2026 — Active Directory GPO distribution only ## Setup Summary (Fastest Path) With a single GPO, configure the following three locations. See Chapter 3 for details. | # | GPO path | Configuration | | - | ------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------- | | 1 | Computer Configuration → Preferences → Windows Settings → Registry | Register each Chrome / Edge ExtensionSettings (force\_installed + update\_url) in HKLM | | 2 | User Configuration → Preferences → Windows Settings → Registry | Register each Chrome / Edge 3rdparty/policy (ApiKey, OrganizationID, etc. + UserEmail=%USEREMAIL%) in HKCU | | 3 | User Configuration → Policies → Windows Settings → Scripts → Logon | Register Set-UserEmailEnv.bat from SYSVOL (for the USEREMAIL environment variable) | Verification after applying (fastest): 1. Link the GPO to the target OU → `gpupdate /force` or sign in again 2. Run `check_extension_registry.bat` (HKLM=ExtensionSettings / HKCU=policy show \[OK]) 3. Reload `chrome://policy` / `edge://policy` in the browser → check the values on the extension options page (refresh with ↻ if not reflected) Obtain ApiKey / CreatedDate / OrganizationID from the admin console. The Logon Script is not needed if you specify UserEmail directly. ## Chapter 1: Overview ### Purpose This document is a setup guide for mass-distributing the browser extension via Active Directory GPO (Group Policy). It focuses on distribution using GPMC Registry Preferences and a logon script. ### Intended Audience IT administrators (Active Directory administrators) and information systems staff. ### Prerequisites | Item | Details | | ----------- | ---------------------------------------------------------- | | OS | Windows 10 or later | | Browser | Google Chrome or Microsoft Edge installed | | Domain | Active Directory domain environment | | Permissions | Permission to create/edit GPOs and place scripts in SYSVOL | Allow the following destinations. | Destination | Port | Purpose | | --------------------------- | ----------- | ----------------------------------- | | clients2.google.com | 443 (HTTPS) | Download / update Chrome extensions | | edge.microsoft.com | 443 (HTTPS) | Download / update Edge extensions | | api.itmc.i.moneyforward.com | 443 (HTTPS) | Data transmission / API access | | itmc.i.moneyforward.com | 443 (HTTPS) | Web access | ### Extension ID | Browser | Environment | Extension ID | | -------------- | ----------- | -------------------------------- | | Google Chrome | PROD | bdeanmdeckegmfjpbnngomallcedjold | | Microsoft Edge | PROD | flggmhlpipcopffjfkpgkoljghfkmfcg | ### Bundled Files | File | Purpose | | -------------------------------------- | ----------------------------------------------------------------------- | | Set-UserEmailEnv.bat | Logon script. Sets the USEREMAIL environment variable | | edge\_chrome\_extension.bat | Alternative: startup script method (see 3.7) | | edge\_chrome\_extension\_uninstall.bat | Complete removal of registry keys and environment variables (Chapter 7) | | check\_extension\_registry.bat | Registry check (read-only) | ## Chapter 2: Overall Configuration The setup consists of two layers: the registry (GPO Preferences) and a user environment variable (logon script). | Layer | GPO placement | Registry | Contents | | -------------------- | ---------------------- | -------- | --------------------------------------------------- | | Forced install | Computer Configuration | HKLM | ExtensionSettings (installation\_mode, update\_url) | | Extension parameters | User Configuration | HKCU | 3rdparty/extensions/\/policy | | Email address | User Configuration | — | Logon Script → USEREMAIL environment variable | ```text theme={null} Computer Configuration → HKLM ExtensionSettings\ installation_mode = force_installed update_url = https://... User Configuration → HKCU 3rdparty\extensions\\policy ApiKey, CreatedDate, OrganizationID UserEmail = %USEREMAIL% UserPC = %COMPUTERNAME% User Configuration → Logon Script Set-UserEmailEnv.bat → USEREMAIL = user@example.com ``` ## Chapter 3: GPO Setup Steps ### GPO Editor Terminology (English UI / Japanese UI) This document uses the English (Japanese) format. Follow the corresponding item based on your GPMC display language. | English (GPMC English UI) | Japanese (GPMC Japanese UI) | | ------------------------- | --------------------------- | | Computer Configuration | コンピューターの構成 | | User Configuration | ユーザーの構成 | | Preferences | 基本設定 | | Policies | ポリシー | | Windows Settings | Windows の設定 | | Registry | レジストリ | | Scripts (Logon/Logoff) | スクリプト（ログオン/ログオフ） | | Logon | ログオン | | Startup | スタートアップ | | Action | 操作 | | Update | 更新 | | Delete | 削除 | How to read a GPO path: follow the GPO editor tree from left to right, as in Computer Configuration → Preferences → … ### 3.1 Obtaining Values from the Admin Console Sign in, open **Settings > Organization > Browser Extension > Extension Policy**, and note the three values ApiKey, CreatedDate, and OrganizationID (fixed values common to all devices). ### 3.2 Creating the GPO 1. Open GPMC and create a new GPO linked to the target OU (for example, `Admina Extension`). 2. Link it to a verification OU first, then roll it out to the production OU once confirmed. From here, configure both Computer Configuration and User Configuration within the same GPO. ### 3.3 Computer Configuration — ExtensionSettings (HKLM) GPO path: Computer Configuration → Preferences → Windows Settings → Registry Common settings: Hive = HKEY\_LOCAL\_MACHINE, Action = Update Registry list under Computer Configuration #### 3.3.1 Chrome — ExtensionSettings Key Path: `Software\Policies\Google\Chrome\ExtensionSettings\bdeanmdeckegmfjpbnngomallcedjold` | Value name | Value type | Value data | | ------------------ | ---------- | -------------------------------------------------------------------------------------------------- | | installation\_mode | REG\_SZ | force\_installed | | update\_url | REG\_SZ | [https://clients2.google.com/service/update2/crx](https://clients2.google.com/service/update2/crx) | Example of the Chrome installation_mode setting Example of the Chrome update_url setting #### 3.3.2 Edge — ExtensionSettings Key Path: `Software\Policies\Microsoft\Edge\ExtensionSettings\flggmhlpipcopffjfkpgkoljghfkmfcg` | Value name | Value type | Value data | | ------------------ | ---------- | ------------------------------------------------------------------------------------------------------------------ | | installation\_mode | REG\_SZ | force\_installed | | update\_url | REG\_SZ | [https://edge.microsoft.com/extensionwebstorebase/v1/crx](https://edge.microsoft.com/extensionwebstorebase/v1/crx) | Writing ExtensionSettings in both HKLM and HKCU causes a conflict and one side is ignored (see Note 3). Always place it only in Computer Configuration (HKLM).

3.4 User Configuration — 3rdparty/policy (HKCU)

GPO path: User Configuration → Preferences → Windows Settings → Registry Common settings: Hive = HKEY\_CURRENT\_USER, Action = Update Registry list under User Configuration #### 3.4.1 Chrome — 3rdparty/policy Key Path: `Software\Policies\Google\Chrome\3rdparty\extensions\bdeanmdeckegmfjpbnngomallcedjold\policy` | Value name | Value type | Value data | | -------------- | --------------- | ---------------------------------------------------------------------- | | ApiKey | REG\_SZ | Value obtained from the admin console | | CreatedDate | REG\_SZ | Value obtained from the admin console (e.g., 2024-07-04T01:11:27.000Z) | | OrganizationID | REG\_SZ | Value obtained from the admin console | | UserEmail | REG\_EXPAND\_SZ | %USEREMAIL% | | UserPC | REG\_EXPAND\_SZ | %COMPUTERNAME% | Example of the ApiKey setting Example of the CreatedDate setting Example of the OrganizationID setting Example of the UserEmail setting Example of the UserPC setting #### 3.4.2 Edge — 3rdparty/policy Key Path: `Software\Policies\Microsoft\Edge\3rdparty\extensions\flggmhlpipcopffjfkpgkoljghfkmfcg\policy` Create the same five items as Chrome (Value name / Value type / Value data are identical) under the Edge Key Path. Do not also write 3rdparty/policy under Computer Configuration (HKLM) (see Note 4). ### 3.5 Logon Script — USEREMAIL Environment Variable If you distribute UserEmail as a %USEREMAIL% reference, you need a logon script that sets the USEREMAIL environment variable at each user's logon (see Note 5). GPO path: User Configuration → Policies → Windows Settings → Scripts (Logon/Logoff) → Logon | Item | Value | | ---------- | ---------------------------------------------------------------- | | Script | `\\\SYSVOL\\scripts\admina\Set-UserEmailEnv.bat` | | Parameters | (empty) | Steps: 1. Edit the DomainPart in Set-UserEmailEnv.bat to your company domain (e.g., `example.com`). 2. Place it in `scripts\admina\` under SYSVOL. 3. Register it as a Logon script using the GPO path above. Example of registering the logon script If you specify the email address directly in UserEmail, the logon script is not needed. ### 3.6 Applying the GPO 1. Link the GPO to the target OU. 2. Run `gpupdate /force` on a verification device, or sign in again. 3. Run `check_extension_registry.bat` using the steps in Chapter 4. ### 3.7 Alternative: Startup Script Method Instead of Registry Preferences, you can place edge\_chrome\_extension.bat in SYSVOL and register it as a Startup script using the following GPO path. Computer Configuration → Policies → Windows Settings → Scripts → Startup Edit the constants in the bat file. | Variable | Recommended value | | ------------------------------------- | ------------------------------- | | ApiKey / CreatedDate / OrganizationID | Obtained from the admin console | | ExtSettingsRoot | HKLM | | PolicyRoot | HKCU | | UserEmailMode | ENV\_REF | The USEREMAIL setting via the logon script (3.5) is still required. ## Chapter 4: Verifying Operation ### 4.1 Verification via the Check Script Run `check_extension_registry.bat` as the target user (read-only). Criteria for a normal result: | Check item | Expected result | | ------------------------ | -------------------------------------------------------------- | | User Environment | USEREMAIL: defined, with the user's email address as the value | | HKCU — ExtensionSettings | All \[--] NOT SET (intentionally not placed) | | HKCU — 3rdparty Policy | All five items \[OK] | | HKLM — ExtensionSettings | Two items (installation\_mode, update\_url) are \[OK] | | HKLM — 3rdparty Policy | All \[--] NOT SET (intentionally not placed) | The Summary's 14 found / 14 missing is normal because both HKCU and HKLM are scanned. The \[--] for "intentionally not placed" is not an error. Example output (verification environment): ```text theme={null} ================================================================ Extension Registry Checker (read-only) Date: 2026/06/09 16:26:51.46 ================================================================ [User Environment] USEREMAIL: defined Value : user@example.com ---------------------------------------- HKCU (HKEY_CURRENT_USER) ---------------------------------------- [Chrome 3rdparty Policy] Key: HKEY_CURRENT_USER\Software\Policies\Google\Chrome\3rdparty\extensions\bdeanmdeckegmfjpbnngomallcedjold\policy [OK] ApiKey = eyJhbGciOiJIUzI1NiIs... [OK] CreatedDate = 2024-07-04T01:11:27.000Z [OK] OrganizationID = 99999999 [OK] UserEmail = user@example.com [OK] UserPc = EXAMPLE-PC ---------------------------------------- HKLM (HKEY_LOCAL_MACHINE) ---------------------------------------- [Chrome ExtensionSettings] Key: HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionSettings\bdeanmdeckegmfjpbnngomallcedjold [OK] installation_mode = force_installed [OK] update_url = https://clients2.google.com/service/update2/crx ================================================================ Summary: 14 found / 14 missing ================================================================ ``` The GPO registers the Value name as UserPC, but the check script references it as UserPc. If the actual registry value shows \[OK], there is no problem. ### 4.2 Verifying Installation in the Browser Even if the registry settings are correct, there is a delay before they are reflected in the browser. | Timing | Details | | ------------------ | --------------------------------------------------------------------------------------- | | Extension download | After the GPO is applied, it may take time to fetch the extension itself from the store | | Policy loading | There is a delay before the browser re-fetches the policy in the background | To check immediately, perform the following two steps in order. 1. Explicitly reload the policy page (4.2.1) 2. Open the extension options page and press refresh (↻) if not reflected (4.2.2) #### 4.2.1 Explicitly Reloading the Policy Chrome 1. Enter `chrome://policy` in the address bar and open it. 2. Click **Reload policies**. 3. Confirm that each value (ApiKey, OrganizationID, UserEmail, etc.) appears with OK under Extension policies at the bottom. Reloading policies on Chrome's chrome://policy Edge 1. Enter `edge://policy` in the address bar and open it. 2. Click **Reload policies**. Reloading policies on Edge's edge://policy The 3rdparty/policy section does not appear on Edge's `edge://policy` (known behavior). Reload the policy anyway, and verify the values on the options page in 4.2.2 (see Note 7). #### 4.2.2 Verifying on the Extension Options Page Chrome 1. Toolbar extension icon → the extension's ︙ (More) → open **Options**. 2. Confirm that "Installed by your administrator" appears in the extension menu. 3. On the options page, confirm the following. * The email address has a Managed tag and a value * The organization ID has the value from the admin console * No error appears at the top of the screen 4. If a value is still empty, press refresh (↻) once at the bottom right of the page. Verifying on the Chrome extension options page Edge 1. Toolbar extension icon → the extension's ︙ (More) → open **Extension options**. 2. As with Chrome, confirm the email address (Managed), organization ID, and no errors. 3. If not reflected, press refresh (↻) once at the bottom right of the page. Verifying on the Edge extension options page #### 4.2.3 Verifying in the Extensions List (Reference) * Chrome: `chrome://extensions` * Edge: `edge://extensions` If the extension shows "Installed by your organization" (Chrome) / "Installed by your administrator" (Edge), the forced installation itself has succeeded. ### 4.3 Diag Data (For Investigation) You can obtain investigation logs from **Diagnostic Data** at the bottom right of the options page. If there is no connectivity, see Chapter 5. ## Chapter 5: Connectivity and Data Verification ### 5.1 Data Arrival Verification Within about 30 minutes, entries from the Chrome / Edge source appear under "Integrations > Event Log". ### 5.2 When There Is No Connectivity Check for warnings via the extension icon → Settings (⚙️). For details, see [How to review Diag data](/en/it-management/shadow-it/344geptwee-diag). ### 5.3 Network Verification ```powershell theme={null} Test-NetConnection -ComputerName api.itmc.i.moneyforward.com -Port 443 ``` ## Chapter 6: Technical Notes ### Note 1: ExtensionSettings = HKLM, 3rdparty/policy = HKCU ExtensionSettings is a per-machine setting. Because the UserEmail in 3rdparty/policy differs per user, it is placed in User Configuration (HKCU). ### Note 2: Action = Update Creates the entry if it does not exist and overwrites it if it does. Replace re-creates the entire key and has side effects. ### Note 3: ExtensionSettings HKLM/HKCU Conflict If it exists in both HKLM and HKCU, only the HKLM side is used. ### Note 4: 3rdparty/policy HKLM/HKCU Conflict If the same value name exists in both, HKLM takes precedence. ### Note 5: Why UserEmail Uses an Environment Variable Reference When Computer Configuration is applied, USEREMAIL is not expanded because it runs in the SYSTEM context. The combination of User Configuration and a logon script is required. ### Note 6: Permissions for HKCU\Software\Policies Only GPO Preferences (User Configuration) can write to HKCU\Software\Policies. A logon script can only set the USEREMAIL environment variable. ### Note 7: 3rdparty/policy Not Shown on edge://policy The values themselves reach the extension. See Appendix A.2. ## Chapter 7: Uninstalling Removing items from the GPO alone leaves the registry values on the device (the GPP "tattoo" effect). ### 7.1 Method A: GPO Delete Action (Recommended) | Placement | Hive | Key Path | Action | | ---------------------- | -------------------- | --------------------------------------------------------------------------------------- | ------ | | Computer Configuration | HKEY\_LOCAL\_MACHINE | `Software\Policies\Google\Chrome\ExtensionSettings\bdeanmdeckegmfjpbnngomallcedjold` | Delete | | Computer Configuration | HKEY\_LOCAL\_MACHINE | `Software\Policies\Microsoft\Edge\ExtensionSettings\flggmhlpipcopffjfkpgkoljghfkmfcg` | Delete | | User Configuration | HKEY\_CURRENT\_USER | `Software\Policies\Google\Chrome\3rdparty\extensions\bdeanmdeckegmfjpbnngomallcedjold` | Delete | | User Configuration | HKEY\_CURRENT\_USER | `Software\Policies\Microsoft\Edge\3rdparty\extensions\flggmhlpipcopffjfkpgkoljghfkmfcg` | Delete | Also remove the logon script from the GPO. ### 7.2 Method B: Uninstall bat Run edge\_chrome\_extension\_uninstall.bat with administrator privileges. It removes both the HKLM / HKCU keys and the USEREMAIL environment variable. After running it, reload the policy at `chrome://policy` / `edge://policy`. ## Appendix A: Verifying Policies in the Browser For detailed steps and screenshots, see Section 4.2. ### A.1 Chrome: chrome://policy After "Reload policies", you can check the Scope (Machine / User) and each value's Status (OK) in the Extension policies section. ### A.2 Edge: Verifying 3rdparty/policy 3rdparty/policy is not shown on `edge://policy`. Verify it on the options page in 4.2.2, or as follows. * Method 1: Check the HKCU values with `check_extension_registry.bat`. * Method 2: In the Service Worker console (`edge://extensions` → Developer mode → Inspect Service Worker), run `chrome.storage.managed.get(null, (data) => console.log(data))`. ## Appendix B: Q\&A ### Q. Does the extension disappear just by unlinking the GPO? A. No. Remove it explicitly using the Delete action in Chapter 7 or edge\_chrome\_extension\_uninstall.bat. ### Q. The check script shows "Some values are missing". A. In the recommended GPO configuration, it is normal for the HKCU-side ExtensionSettings and the HKLM-side 3rdparty/policy to show \[--] (see Section 4.1). ### Q. The registry is OK but the extension does not appear in the browser. A. There is a delay in downloading the extension and loading the policy. Try the steps in Section 4.2 (reload the policy → refresh ↻ on the options page). ### Q. What if whoami /upn is not available in the environment? A. Set the DomainPart in Set-UserEmailEnv.bat correctly. ### Q. What if SKYSEA or similar uses ExtensionSettings? A. Because the extension IDs differ, they can coexist at the subkey level. Align the source hive (HKLM / HKCU) with your asset management software.