Microsoft Intune (Windows)

Best for: Organizations managing Windows devices through Microsoft Intune.

You deploy one Intune Remediation: two PowerShell scripts that write the extension's managed configuration and force-install the extension.

note

Remediations need a Windows Enterprise or Education licence (included in Microsoft 365 E3, E5, F3 and Business Premium). Without one, deploy the remediation script as a Platform script instead.

Step 1: Choose your install method

On a managed device, open edge://policy or chrome://policy and check which of these policies are set:

You see	Set `$installVia` to
No `ExtensionSettings`	`"ExtensionSettings"`
`ExtensionSettings`, but no `ExtensionInstallForcelist`	`"Forcelist"`
Both	`"None"`, then follow the steps below

Ignore an ExtensionInstallForcelist that contains only SlashID. It came from an earlier version of this guide.

If you see both policies

The scripts deliver only the configuration, and you install the extension through your own policy:

Complete Steps 2 and 3, then wait until your devices show Without issues.

Add SlashID to the policy you already deploy extensions with.

ExtensionInstallForcelist:

jmmgnjennniheaocoocojcdidefgmapi;https://extension-install.slashid.com/updates.xml

ExtensionSettings:

"jmmgnjennniheaocoocojcdidefgmapi": {
  "installation_mode": "force_installed",
  "update_url": "https://extension-install.slashid.com/updates.xml"
}

Upgrading an existing deployment?

Change $installVia and redeploy. SlashID stays installed while the scripts switch over. With "None", add SlashID to your own policy first.

Step 2: Prepare the scripts

Edit the settings block at the top of both scripts:

$token: the activation code of your SlashID Sensors data source.
$silentOnboarding: $false to turn off Silent Onboarding.
$installVia: from Step 1.
$browsers: leave both unless you never deploy one of them.

Detection script

Save as slashid-detect.ps1.

$token            = "SLASHID_SENSOR_TOKEN"
$silentOnboarding = $true
$installVia       = "ExtensionSettings" # "ExtensionSettings", "Forcelist" or "None" - see Step 1
$browsers         = @("Chrome", "Edge")

$extensionId = "jmmgnjennniheaocoocojcdidefgmapi"
$updateUrl   = "https://extension-install.slashid.com/updates.xml"
$policyRoots = @{
  Chrome = "HKLM:\SOFTWARE\Policies\Google\Chrome"
  Edge   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
}
$ErrorActionPreference = "Stop"

function Get-ForcelistEntries($path) {
  if (-not (Test-Path $path)) { return @() }
  $key = Get-Item -Path $path
  @($key.Property | ForEach-Object { $key.GetValue($_) })
}

function Get-ExtensionSettings($root) {
  $json = (Get-ItemProperty -Path $root -Name ExtensionSettings -ErrorAction SilentlyContinue).ExtensionSettings
  if (-not $json) { return [pscustomobject]@{} }
  $settings = ($json -join "`n") | ConvertFrom-Json
  if ($settings) { $settings } else { [pscustomobject]@{} }
}

try {
  foreach ($browser in $browsers) {
    $root          = $policyRoots[$browser]
    $policyPath    = "$root\3rdparty\extensions\$extensionId\policy"
    $forceListPath = "$root\ExtensionInstallForcelist"

    if (-not (Test-Path $policyPath)) {
      Write-Output "${browser}: managed configuration missing"
      exit 1
    }
    $policy = Get-ItemProperty -Path $policyPath
    if ($policy.sidEventStreamingToken -ne $token) {
      Write-Output "${browser}: token differs"
      exit 1
    }
    if ($silentOnboarding -and $policy.sidSilentOnboarding -ne 1) {
      Write-Output "${browser}: silent onboarding flag missing"
      exit 1
    }
    if (-not $silentOnboarding -and $null -ne $policy.sidSilentOnboarding) {
      Write-Output "${browser}: silent onboarding flag should be removed"
      exit 1
    }

    $forceList      = Get-ForcelistEntries $forceListPath
    $inForcelist    = [bool]($forceList | Where-Object { $_ -like "$extensionId;*" })
    $onlyInForcelist = $inForcelist -and $forceList.Count -eq 1
    $settings       = Get-ExtensionSettings $root
    $entry          = $settings.$extensionId
    $onlyInSettings = $entry -and @($settings.PSObject.Properties).Count -eq 1

    switch ($installVia) {
      "ExtensionSettings" {
        if (-not $entry -or $entry.installation_mode -ne "force_installed" -or $entry.update_url -ne $updateUrl) {
          Write-Output "${browser}: ExtensionSettings entry missing"
          exit 1
        }
        if ($inForcelist) {
          Write-Output "${browser}: force-install list entry should be removed"
          exit 1
        }
      }
      "Forcelist" {
        if (-not ($forceList -contains "$extensionId;$updateUrl")) {
          Write-Output "${browser}: force-install list entry missing"
          exit 1
        }
        if ($onlyInSettings) {
          Write-Output "${browser}: ExtensionSettings entry should be removed"
          exit 1
        }
      }
      "None" {
        if ($onlyInForcelist -or $onlyInSettings) {
          Write-Output "${browser}: install entry written by an earlier method should be removed"
          exit 1
        }
      }
      default {
        Write-Output "Unknown installVia value: $installVia"
        exit 1
      }
    }
  }
}
catch {
  Write-Output "Detection failed: $_"
  exit 1
}

Write-Output "SlashID Browser Extension policy present"
exit 0

Remediation script

Save as slashid-remediate.ps1.

$token            = "SLASHID_SENSOR_TOKEN"
$silentOnboarding = $true
$installVia       = "ExtensionSettings" # "ExtensionSettings", "Forcelist" or "None" - see Step 1
$browsers         = @("Chrome", "Edge")

$extensionId = "jmmgnjennniheaocoocojcdidefgmapi"
$updateUrl   = "https://extension-install.slashid.com/updates.xml"
$policyRoots = @{
  Chrome = "HKLM:\SOFTWARE\Policies\Google\Chrome"
  Edge   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
}
$ErrorActionPreference = "Stop"

Remove-TypeData System.Array -ErrorAction SilentlyContinue

function Get-ExtensionSettings($root) {
  $json = (Get-ItemProperty -Path $root -Name ExtensionSettings -ErrorAction SilentlyContinue).ExtensionSettings
  if (-not $json) { return [pscustomobject]@{} }
  $settings = ($json -join "`n") | ConvertFrom-Json
  if ($settings) { $settings } else { [pscustomobject]@{} }
}

function Add-SettingsEntry($root) {
  $settings = Get-ExtensionSettings $root
  $settings | Add-Member -Force -NotePropertyName $extensionId -NotePropertyValue ([pscustomobject]@{
    installation_mode = "force_installed"
    update_url        = $updateUrl
  })
  Set-ItemProperty -Path $root -Name ExtensionSettings -Value ($settings | ConvertTo-Json -Compress -Depth 10) -Type String
}

function Remove-OwnSettingsValue($root) {
  $settings = Get-ExtensionSettings $root
  $names = @($settings.PSObject.Properties.Name)
  if ($names.Count -eq 1 -and $names[0] -eq $extensionId) {
    Remove-ItemProperty -Path $root -Name ExtensionSettings
  }
}

function Add-ForcelistEntry($path) {
  # Create keys only when missing: New-Item -Force on an existing key has
  # been observed to clear its values.
  if (-not (Test-Path $path)) {
    New-Item -Path $path -Force | Out-Null
  }
  $forceList = Get-Item -Path $path
  $names     = @($forceList.Property)
  $entryName = $names | Where-Object { $forceList.GetValue($_) -like "$extensionId;*" } | Select-Object -First 1
  if (-not $entryName) {
    $index = 1
    while ($names -contains "$index") { $index++ }
    $entryName = "$index"
  }
  Set-ItemProperty -Path $path -Name $entryName -Value "$extensionId;$updateUrl" -Type String
}

function Remove-ForcelistEntry($path) {
  if (-not (Test-Path $path)) { return }
  $forceList = Get-Item -Path $path
  $entries   = @($forceList.Property | Where-Object { $forceList.GetValue($_) -like "$extensionId;*" })
  if ($entries.Count -eq 0) { return }
  foreach ($name in $entries) { Remove-ItemProperty -Path $path -Name $name }
  if (@((Get-Item -Path $path).Property).Count -eq 0) { Remove-Item -Path $path }
}

function Remove-OwnForcelist($path) {
  if (-not (Test-Path $path)) { return }
  $forceList = Get-Item -Path $path
  $names     = @($forceList.Property)
  if ($names.Count -eq 1 -and $forceList.GetValue($names[0]) -like "$extensionId;*") {
    Remove-Item -Path $path
  }
}

try {
  foreach ($browser in $browsers) {
    $root          = $policyRoots[$browser]
    $policyPath    = "$root\3rdparty\extensions\$extensionId\policy"
    $forceListPath = "$root\ExtensionInstallForcelist"

    # Managed configuration first, so the extension never starts without it.
    if (-not (Test-Path $policyPath)) {
      New-Item -Path $policyPath -Force | Out-Null
    }
    Set-ItemProperty -Path $policyPath -Name "sidEventStreamingToken" -Value $token -Type String
    if ($silentOnboarding) {
      Set-ItemProperty -Path $policyPath -Name "sidSilentOnboarding" -Value 1 -Type DWord
    } else {
      Remove-ItemProperty -Path $policyPath -Name "sidSilentOnboarding" -ErrorAction SilentlyContinue
    }

    switch ($installVia) {
      "ExtensionSettings" {
        Add-SettingsEntry $root
        Remove-ForcelistEntry $forceListPath
      }
      "Forcelist" {
        Add-ForcelistEntry $forceListPath
        Remove-OwnSettingsValue $root
      }
      "None" {
        Remove-OwnForcelist $forceListPath
        Remove-OwnSettingsValue $root
      }
      default {
        throw "Unknown installVia value: $installVia"
      }
    }
  }

  Write-Output "SlashID Browser Extension policy remediated"
  exit 0
}
catch {
  Write-Output "Remediation failed: $_"
  exit 1
}

Step 3: Create the Remediation in Intune

Navigate Devices -> Manage devices -> Scripts and remediations, open the Remediations tab and choose Create.

On the Settings step, upload slashid-detect.ps1 as the detection script and slashid-remediate.ps1 as the remediation script, and set:

Run this script using the logged-on credentials: No (the scripts write to HKLM, which needs SYSTEM)
Enforce script signature check: No
Run script in 64-bit PowerShell: Yes

On the Assignments step, select your device groups and a schedule (hourly while rolling out, daily afterwards).

Verifying on a device

In edge://policy or chrome://policy:

SlashID appears in the policy for your install method.
Its managed values appear under jmmgnjennniheaocoocojcdidefgmapi.
Your other extensions are still listed, with no conflict warnings.

In Intune, devices show Without issues.

Microsoft Intune (Windows)

Step 1: Choose your install method​

If you see both policies​

Step 2: Prepare the scripts​

Detection script​

Remediation script​

Step 3: Create the Remediation in Intune​

Verifying on a device​