Skip to content
AImori
EN
Free for Chrome
Menu

Deployment via Group Policy (ADMX)

The ADMX templates are not part of the extension package; they are in the source code on GitHub in the enterprise/admx/ folder (GitHub): one template each for Edge and Chrome, in en-US and de-DE, shipped with the store ID lefajbhockjgdhaohnacgaggfepianjh. They write to HKLM\Software\Policies\Microsoft\Edge\3rdparty\extensions\lefajbhockjgdhaohnacgaggfepianjh\policy or HKLM\Software\Policies\Google\Chrome\3rdparty\extensions\lefajbhockjgdhaohnacgaggfepianjh\policy – exactly where the browser reads the extension's managed policy.

On this page

Steps

  1. Copy dlx-edge.admx / dlx-chrome.admx to the Central Store (\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions), and the ADML files to the subfolders en-US or de-DE. Locally: C:\Windows\PolicyDefinitions.
  2. Edit the GPO → Computer Configuration → Administrative Templates → "AImori (Microsoft Edge)" or "(Google Chrome)".
  3. Configure the settings (meaning). Lists (country packs, allowed sites, checksums of your own terms) are entered one per line; "Rules per data type" as name (data type ID) and value (off/warn/redact/block).
  4. Force-install the extension: with the browser templates from Microsoft or Google, set the policy ExtensionInstallForcelist (or ExtensionSettings) – entry lefajbhockjgdhaohnacgaggfepianjh;https://clients2.google.com/service/update2/crx (extension from the Chrome Web Store, works for Edge and Chrome).
  5. Run gpupdate /force, then check edge://policy or chrome://policy in the browser; the extension shows "Managed by …".
  • DeveloperToolsAvailability = 2 for users without a need for developer tools (anyone who can use developer tools or extension management can bypass the protection).
  • Install the extension via forcelist so it cannot be disabled.
  • URLBlocklist for a hard block of AI sites that are not approved: the extension's block page (aiSiteMode: block) is only an overlay.
  • Block AI desktop apps via AppLocker or Intune if only the protected browser should be used.

Different extension ID

The templates contain the ID. For a different ID, for example your own signed package, regenerate the templates from the source code and distribute the new files:

node scripts/build-admx.mjs --id <ID>
Free for Chrome