> For the complete documentation index, see [llms.txt](https://boza.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://boza.gitbook.io/docs/browser-extension/deployment/gpo.md).

# Group Policy (GPO)

Force-install the Boza extension on **Google Chrome**, **Microsoft Edge**, or both across domain-joined Windows computers.

{% hint style="warning" %}
This policy installs the extension but does not identify the user automatically. Users sign in once with Boza SSO unless you separately deploy a [Boza-supported Windows automatic-identification procedure](/docs/browser-extension/deployment/powershell.md) whose behavior has been confirmed.
{% endhint %}

***

## Prerequisites

* Group Policy Management Console (GPMC) on a domain controller or management workstation.
* Delegated rights to create, edit, and link a GPO to the target OU.
* Target computer accounts in a test OU or security group.
* Current Chrome and/or Edge administrative templates.
* Outbound access from client browsers to the Chrome Web Store update service.

Use a delegated Group Policy administrator account where possible. Domain Admin membership is not required for routine policy creation when permissions have been delegated correctly.

***

## 1. Install the Official Browser Policy Templates

Use only the current templates from the browser vendor:

* **Chrome:** [Chrome Enterprise policy-template bundle](https://support.google.com/chrome/a/answer/7650032?hl=en), [Chrome Enterprise downloads](https://chromeenterprise.google/download/), and [Google's Windows policy-template instructions](https://support.google.com/chrome/a/answer/7649838?hl=en).
* **Edge:** [Microsoft's Edge policy setup guide](https://learn.microsoft.com/en-us/deployedge/configure-microsoft-edge).

If your domain uses a Group Policy Central Store, copy templates there rather than into the local `C:\Windows\PolicyDefinitions` folder. The usual Central Store path is:

```
\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions
```

### Chrome files

From the Chrome Enterprise policy bundle under `windows\admx`, copy:

* `google.admx`
* `chrome.admx`
* The matching `google.adml` and `chrome.adml` files from your language folder

### Edge files

From the Microsoft Edge policy bundle under `windows\admx`, copy:

* `msedge.admx`
* The matching `msedge.adml` file from your language folder

The Edge update and WebView templates are not required to configure the Boza extension.

{% hint style="info" %}
Do not overwrite a Central Store template without checking its version and language. Follow your normal change-control and domain-replication process.
{% endhint %}

***

## 2. Create and Scope the GPO

1. Open **Group Policy Management**.
2. Under **Group Policy Objects**, create a GPO such as `Boza Browser Extension`.
3. Link it to the OU containing the target **computer accounts**.
4. Use security filtering if only a subset of computers should receive the policy.
5. Start with a small pilot group.

Configure the force-install settings under **Computer Configuration** so the extension applies consistently to everyone using the managed device.

***

## 3. Force-install in Chrome

1. Edit the GPO.
2. Go to **Computer Configuration > Policies > Administrative Templates > Google > Google Chrome > Extensions**.
3. Open **Configure the list of force-installed apps and extensions**.
4. Select **Enabled**, then select **Show**.
5. Add this value as a new list item:

```
lgdogpphmkjofjogicpokolmlmcfilja;https://clients2.google.com/service/update2/crx
```

6. Save the policy.

The exact policy name is `ExtensionInstallForcelist`. See Google's [policy reference](https://chromeenterprise.google/policies/extension-install-forcelist/).

***

## 4. Force-install in Microsoft Edge

1. In the same GPO, go to **Computer Configuration > Policies > Administrative Templates > Microsoft Edge > Extensions**.
2. Open **Control which extensions are installed silently**.
3. Select **Enabled**, then select **Show**.
4. Add this value as a new list item:

```
lgdogpphmkjofjogicpokolmlmcfilja;https://clients2.google.com/service/update2/crx
```

5. Save the policy.

The exact policy name is `ExtensionInstallForcelist`. See Microsoft's [Edge policy reference](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/extensioninstallforcelist).

***

## 5. Optional: Pin the Extension

Pinning is separate from force-installation. If your organization already manages `ExtensionSettings`, merge the Boza entry into the existing JSON—do not replace settings for other extensions.

### Chrome

Under **Google Chrome > Extensions**, open **Configure extension management settings** and add:

```json
{"lgdogpphmkjofjogicpokolmlmcfilja":{"toolbar_pin":"force_pinned"}}
```

### Edge

Under **Microsoft Edge > Extensions**, open **Configure extension management settings** and add:

```json
{"lgdogpphmkjofjogicpokolmlmcfilja":{"toolbar_state":"force_shown"}}
```

Store the JSON on one line in the policy editor.

***

## 6. Apply and Validate

On a pilot client:

1. Run `gpupdate /force`.
2. Completely close and reopen the browser.
3. Open `chrome://policy` or `edge://policy`, then select **Reload policies**.
4. Confirm `ExtensionInstallForcelist` contains `lgdogpphmkjofjogicpokolmlmcfilja`.
5. Open `chrome://extensions` or `edge://extensions`.
6. Confirm Boza is present and marked as installed by your organization.
7. Open Boza and complete the one-time SSO sign-in.

The policy also appears in the registry:

```
HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist
```

Each list should contain a `REG_SZ` value with the complete Boza extension string. Do not export screenshots or diagnostics that reveal other managed policy values.

***

## Troubleshooting

### The browser templates do not appear

* Confirm the `.admx` files are in the active Central Store and the `.adml` files are in its matching language folder.
* Close and reopen Group Policy Management Editor.
* Check SYSVOL replication before editing the GPO from another domain controller.

### The GPO is not applied

* Run `gpresult /h Boza-GPResult.html` on the client and inspect the computer policy result.
* Confirm the computer account—not only the user account—is inside the linked OU.
* Check security filtering, WMI filters, inheritance, and enforced/block-inheritance settings.

### The policy appears but Boza is not installed

* Confirm the full ID and update URL are exact.
* Check that a higher-precedence GPO or another management system does not block the extension.
* Verify the device can reach `clients2.google.com`.
* Review errors in `chrome://policy` or `edge://policy`.

### Boza is installed but asks the user to sign in

That is expected for policy-only GPO deployment. Complete SSO, or add automatic identification with a Boza-supported [PowerShell deployment procedure](/docs/browser-extension/deployment/powershell.md) after confirming the supplied script's capabilities.

### The extension is not pinned

* Confirm the `ExtensionSettings` JSON is valid and compact.
* Merge the Boza object with existing extension settings rather than publishing two competing values.
* Reload policies and restart the browser.

***

## Remove the Deployment

Edit the GPO and remove only the Boza item from `ExtensionInstallForcelist` and, if used, only the Boza object from `ExtensionSettings`. After the client refreshes policy, the browser removes the force-installed extension.

Do not delete a shared force-install list or extension-settings policy that contains other managed extensions.

If you paired GPO with automatic identification, use the removal procedure that Boza or its accompanying documentation explicitly matches to the exact deployment you used so managed identity values are removed safely.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://boza.gitbook.io/docs/browser-extension/deployment/gpo.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.