How to install DLP Endpoint Chrome and Microsoft Edge Extension through GPO

Technical Articles ID: KB95923
Last Modified: 2023-03-14 10:22:56 Etc/GMT

Environment

Data Loss Prevention (DLP) Endpoint 11.x

For supported environments, see KB68147 - Supported platforms for Data Loss Prevention Endpoint.

Summary

For a few customers, internet access isn't allowed in the employee computer or their computers might be behind a firewall. These restrictions lead to the following:

Access to the Chrome or Edge web store isn't allowed
Installation of the Chromium browser extension in respective browsers isn't allowed after installing DLP Endpoint

The above restrictions result in issues such as DLP not recognizing or capturing the URL. The Text Post monitoring in Chromium browsers doesn't function as well.

This article provides the instructions to install DLP Endpoint Chrome and Microsoft Edge Extension offline.

Preconditions:

The DLP Endpoint client system must be domain-joined (DC).
Enable the following option:
Policy Catalog, Data Loss Prevention, Windows Client Configuration, Edit, Operational Mode and Modules, Chrome and Edge web extension - for identifying address bar URL.
Download the extension and create a shared location:
- Get the extension ID from the test system.
  1. Install the latest DLP Endpoint build on a test system.
  2. Open the Registry editor and access HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\ or Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\
    
    For DLP Endpoint builds lesser than 11.10, get the "last" value from the key com.mcafee.dlp_native_messaging_host
    
    For DLP Endpoint builds 11.10 onward, get the "last" value from the key com.trellix.dlp_native_messaging_host
  This is the extension ID we would need to install on our agent.
- Open any browser and download the extension crx package using the steps below:
  1. Get the Chrome version from the About option of the browser.
  2. Replace CHROME_VERSION and EXTENSION_ID in the URL below:
    https://clients2.google.com/service/update2/crx?response=redirect&prodversion=CHROME_VERSION&acceptformat=crx2,crx3&x=id%3DEXTENSION_ID%26uc
  3. The file will be in .crx format; save the extension file. For example, extension.crx
    1. Extract the extension version from extension.crx.
    2. Extract the crx file.
    3. Open manifest.json and get the version number from the highlighted field. (Let's call it version_X)
  4. Create the extension package file (.xml)
    1. Create a shared folder on the server, which is accessible to DLP Endpoint. For example, \\hostname\extensions
    2. Place the downloaded extension.crx package in the folder.
    3. Create an XML file as shown below:
      <Replace EXTENSION_ID and version_X>
      <?xml version='1.0' encoding='UTF-8'?>
      <gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'>
      <app appid='EXTENSION_ID'>
      <updatecheck codebase='file://///hostname/extensions/extension.crx' version='version_X' />
      </app>
      </gupdate>
    4. Save the XML in the same shared folder.

Solution

Domain Controller Admin Steps for Creating GPO in Google Chrome:

Download the adm/admx template files.
Open gpmc.msc
Create the Chrome policy under a new GPO and name the policy.
Right click on the newly created policy.
Edit the Chrome policy.
The Group Policy Management Editor opens. Navigate to Computer Configuration, Policies, Administrative Templates.

NOTE: Use the Computer configuration option only.
Right click and select Add/Remove Templates.
Go to the downloaded Chrome policy template path and select chrome.adm
Click Open.
Select and open Configure the list of force-installed apps and extensions.
Select the Enabled radio button.
Click on the Show button.
Add the value in the format EXTENSION_ID;file://///hostname/extensions/ext_install.xml
Click OK.
Close the Group Policy Management Editor.
Go to gpmc.msc and link the policy at the OU level and select the Chrome policy created.
Go to the Chrome policy and add the desired system to have this policy reflected/enforced.

Domain Controller Admin Steps for Creating GPO in MS Edge:

Go to Download.
Extract the package.
Open gpmc.msc
Edit the policy created for Chrome or create a new policy.
The Group Policy Management Editor opens. Navigate to Computer Configuration, Policies, Administrative Templates.

NOTE: Use the Computer configuration option only.
Select the downloaded msedge.adm policy.
Add the EXTENSION_ID;file://///hostname/extensions/ext_install.xml (refer to the steps for Chrome).
Apply and save.
If you've created an additional policy, link an existing GPO.

Enforce the Policy on the DLP Endpoint Machine:

Open cmd and run gpupdate /force
To confirm that the extension has been loaded correctly, go to the Browser and check for Policy.
Open:
Chrome: chrome://policy
MS Edge: edge://policy
Check "ExtensionInstallForcelist." The value configured on GPO is loaded.
Go to Broswer, Extensions and check whether the Trellix/McAfee DLP Endpoint extension is loaded.
Go to Regedit, and check for the keys below:
Chrome: SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
MS Edge: SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist
Check if the extension is loaded. If not, a browser restart is recommended.

NOTE: Extensions are successfully added on test machines.

Recommended Method to Update Chromium Extension with DLP Endpoint Upgrade While Running Group Extension Update:

These are the steps that customers can follow to make sure that extensions are properly configured by GPO after or while DLP Endpoint is updated on agent machines.

Add the new and old extension IDs on the same GPO policy for both Chrome and Edge.
After running the GPO update on Endpoint, the registry will look similar to the following screenshot:
Run the DLP Endpoint update. Once successfully completed, proceed to the next step.
Check in Browser, Extensions if the extension is loaded (two extensions will be loaded).

NOTE: If the extensions aren't loaded, a browser restart is recommended. If two extensions are loaded, it isn't a problem as fcnm.exe will be running from the latest extension supported by DLP Endpoint.
Once all the systems under the GPO policy have the updated DLP Endpoint version, remove the older extension values from GPO. This makes sure that only one extension is loaded properly on the browser.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

How to install DLP Endpoint Chrome and Microsoft Edge Extension through GPO

Environment

Summary

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

How to install DLP Endpoint Chrome and Microsoft Edge Extension through GPO

Environment

Summary

Solution

Affected Products

Languages:

Choose your region

Title

Title