0

Is it possible to lock extensions on chrome (make them inaccessible) preferably on registry or on the computer level. I want to use some productivity tools but they are so easy to bypass i know you can prevent uninstallation in the windows registry, but is it possible to prevent accessing them? Thanks in advance

1 Answer 1

0

Depending on what you mean by "lock" the extensions, this can mostly be done using file system permissions / ACLs. Each extension installs into a known location on the file system, based on the extension's unique ID.

You can block specific extensions from being installed by creating the subdirectories they would install into, and then denying users the rights to delete those subdirectories or to write files into them. If you instead want to block most (or all) extensions, you can edit the permissions of the parent directory (the location where extension subdirectories get created) to disallow the user creating or editing subdirectories within it, and then either leave it as is (blocking all extension installation) or use elevated privileges to install specific extensions. Users would still be able to turn extensions on and off (unless you block writes to the location where that's configured), but they wouldn't be able to install arbitrary ones.

However, there's a lot of caveats here. First of all, this obviously doesn't work if your users have access to admin/root privileges, otherwise they can just override the ACLs. Second, Chrome is (mostly) open source and can be installed and run without needing admin privileges; a user could easily install a modified version (and it wouldn't take much effort for a programmer to produce one) that uses a different extension directory. Indeed, there's already a "portable" build of Chrome that is designed to run from a flashdrive, but can be run from anywhere, and has its own extensions directory. Third, most Chrome extensions are also available as Firefox and/or Edge extensions - they all use near-identical extension models and APIs - so you'd have to do this for all browsers if you wanted to be sure.

Frankly, trying to lock down systems so that users can't run stuff they want to is a very difficult process, especially if keep the machine useful in general and don't want to create an enormous IT maintenance burden. This has been known to parents and school officials for decades, and determined adults are far more capable than the school-age children that people have been trying to restrict for decades.

You must log in to answer this question.