Chrome / Safari Extensions

[Eskobar]

Hi everyone,

I'd like to ban users from disabling chrome/safari specific extension (McAfee Endpoint Security Web Control).

Any idea for the config to setup in jamf ? Should I rebuild Chrome bundle or just push a policy ?

[AJPinto]

• For Safari you cant. Apple has changed Safari to use something called App Extensions. These Extensions require the user to manually approve to enable in the browser, you cannot force enable. As well as there is no way to prevent a user from disabling the Extension. I have not dug in to this, but it possible to write a daemon to check to see if an extension is enabled and nag the user to enable it. 
• For Chrome you just push a configuration profile to tell Chrome to install the Extension. This is an example of a configuration profile for the walkme browser extension. 

[markdmatthews · Accepted solution]

com.google.Chrome.plist example:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>ExtensionInstallBlacklist</key>

  <array>

  <!-- ID for Hover Zoom -->

  <string>nonjdcjchghhkdoolnlbekcfllmednbl</string>

</array>

</dict>

</plist>

[Eskobar]

Thanks @markdmatthews 

Hence my xml text should be :

com.google.Chrome.plist example:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>ExtensionInstallBlacklist</key>

<array>

<!-- jjkchpdmjjdmalgembblgafllbpcjlei -->

<string>jjkchpdmjjdmalgembblgafllbpcjlei</string>

</array>

</dict>

</plist>

------------

I already block the extension with jsaon file but user can desable the extension in "Incognito Mode" !! Any idea how to force ex every where ?

 

[Eskobar]

Hello,

Ihave blocked Incognito mode as well. Looks we cannot force extension enabled in Incognito mode .

May I will have to create some report to show whether safari extension are allowed or not buy user or even block safari :)