Get your copy of the SaaS Attacks Report: 2024 edition

Ready to help

How to undo a Group Policy-managed Push browser extension rollout

This guide covers the steps required to roll back the deployment of the Push browser extension via Microsoft Group Policy. The installation steps are covered in our browser extension documentation.

Remove the auto-deploy settings

First, you'll need to remove the browser extension's auto-deploy settings.

1. In the Microsoft Group Policy Management tool, right-click on the specific group policy object used for deploying the browser settings to endpoints, and click Edit.

2. In the new Group Policy Management Editor window, expand Computer Configuration > Policies > Administrative Templates.

For Google Chrome

Here's how to remove browser-specific settings for Chrome.

1. To remove the settings related to Google Chrome, expand the Google Chrome node, then click on the Extensions item.

2. Double-click on the Configure the list of force-installed apps and extensions setting.

Chrome Group Policy select force install setting: KB 10062
Navigate to the Google Chrome extension settings

On the resulting screen, click on Show..., and locate the following value:

dljjddkmmcminffjbcmeccgfbjlhmhlm;https://clients2.google.com/service/update2/crx

3. Double-click on the value, then select and delete the contents of the Value field. Finally, click OK.

Chrome Group Policy remove extension value: KB 10062
The browser extension force-install configuration value

Note: If this is the last or only entry in the Value list, then Group Policy will display an error stating that no entries were added to the list, as it requires at least one entry. In this case, you can leave the value entry as-is, and instead set the policy to Not Configured, as per the image below.

Chrome Group Policy set policy to not configured: KB 10062

Important! You should only set this if you don't have other extensions that you manage via this method in this policy.

For Microsoft Edge

Here's how to remove browser-specific settings for Microsoft Edge.

1. To remove the settings related to Microsoft Edge, expand the Microsoft Edge node, then click on the Extensions item.

2. Double-click on the Control which extensions are installed silently setting.

Edge Group Policy select force install setting: KB 10062

3. On the resulting screen, click on Show..., and locate the following value:

dljjddkmmcminffjbcmeccgfbjlhmhlm;https://clients2.google.com/service/update2/crx

4. Double-click on the value, followed by selecting and deleting the contents of the Value field. Finally, click OK.

Edge Group Policy remove extension value: KB 10062
The browser extension silent install configuration value

Note: If this is the last or only entry in the Value list then group policy will display an error stating that no entries were added to the list, as it requires at least one entry. In this case, you can leave the value entry as-is, and instead set the policy to Not Configured, as per the image below.

Edge Group Policy set policy to not configured: KB 10062

Important! You should only set this if you don't have other extensions that you manage via this method in this policy.

For Firefox

Here’s how to remove browser-specific settings for Mozilla Firefox.

1. To remove the settings related to Firefox, expand the Firefox node, then click on the Extensions item.

2. Double-click on the Extensions to Install setting.

Firefox - group policy editor - KB 10062

On the resulting screen, click on Show…, and locate the following value:

https://addons.mozilla.org/firefox/downloads/latest/push-security/latest.xpi

3. Double-click on the value, then select and delete the contents of the Value field. Finally, click OK.

Firefox - group policy editor step 2 - KB 10062

Note: If this is the last or only entry in the Value list, then Group Policy will display an error stating that no entries were added to the list, as it requires at least one entry. In this case, you can leave the value entry as-is, and instead set the policy to Not Configured, as per the image below.

Important! You should only set this if you don't have other extensions that you manage via this method in this policy.

Firefox - group policy editor step 3 - KB 10062

Remove the extension-specific registry settings

As part of the extension deployment, you were required to deploy registry keys that configure policy settings for the extension. You'll need to remove those.

1. To remove the registry keys, open the group policy object that contains the registry settings, and navigate to Computer Configuration, expand Preferences > Windows Settings, and click on the Registry node.

If this policy was used exclusively for deploying these settings, you should see a screen that resembles the following image:

Group policy editor showing extension policy registry keys: KB 10062
Extension-specific policy registry keys

The purpose of the policy registry item is to create the general registry key required to store extension policy values. It's important to note that this may be used by other extensions deployed within your environment. If you are not sure, it's OK to leave this registry key as-is to avoid an unexpected impact.

The token registry key is the only item that contains a value that would have an effect on the Push browser extension. To remove it, right-click on the token item and select properties.

Group policy editor registry right click properties: KB 10062

2. On the token properties window, set the Action to Delete, and click OK.

Group policy editor set token to delete: KB 10062

You may now close the Group Policy Management Editor. The Push browser extension uninstallation will be complete once the settings propagate across your organization.

You should only set this if you don't have other extensions that you manage via this method in this policy.

Firefox - group policy editor step 3 - KB 10062

Do I need to remove the administrative templates?

If you do not use Google Chrome, Microsoft Edge, or Firefox administrative templates to manage other aspects of the browsers in your organization, it is safe to remove the templates. However, this step is not necessary and you can leave them in place.

Note: If you manage any other settings in Chrome, Edge, or Firefox via group policy, these files should not be removed.

If you do want to remove the templates, perform the following steps on a host that manages your Active Directory environment.

1. Remove the chrome.admx, msedge.admx, and firefox.admx files from the following location:
%systemroot%\sysvol\domain\policies\PolicyDefinitions
2. In the same policy files location, open the language folder appropriate to your locale (e.g. en-US) and remove the chrome.adml, msedge.adml, and firefox.adml files under the PolicyDefinitions folder:
%systemroot%\sysvol\domain\policies\PolicyDefinitions\en-US

This will remove the administrative templates from your Active Directory environment.