Skip to main content
InvestigAItor

GPO Deployment (Windows)

Deploy InvestigAItor silently to every domain-joined Windows machine using Group Policy. No employee interaction required.

Tip: Sign in to the admin dashboard and refresh this page to see your enrollment key pre-filled.

Prerequisites

Windows Server with Active Directory
Group Policy Management Console (GPMC)
Target machines are domain-joined
Chrome or Edge ADMX templates in your Central Store

Download Chrome ADMX from chromeenterprise.google and copy to \\yourdomain.com\SYSVOL\...\PolicyDefinitions\.

Step 1: Create a GPO

  1. Open GPMC (gpmc.msc)
  2. Right-click your target OU → Create a GPO in this domain, and Link it here
  3. Name it InvestigAItor Extension
  4. Right-click the new GPO → Edit

Step 2: Force-install the extension

Navigate to:

Computer Configuration → Policies → Administrative Templates
  → Google Chrome → Extensions
    → Configure the list of force-installed extensions

Enable it, click Show, and add:

ncibbcpcjhieaffkncaeemcfihlhkcdg;https://investigaitor.org/extension/extension-update.xml

Step 3: Set enrollment config (Computer Configuration)

These values register the device with your organization. Navigate to:

Computer Configuration → Preferences → Windows Settings → Registry

Create two REG_SZ values under this key path. Names are case-sensitive:

HKLM\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\ncibbcpcjhieaffkncaeemcfihlhkcdg\policy
Value Name
Value Data
enrollmentToken
YOUR_ENROLLMENT_KEY
deviceName
%COMPUTERNAME%

Step 4: Set user identity (User Configuration)

These values identify who is using the device. They must be set via User Configuration so per-user variables like %USERNAME% expand correctly.

User Configuration → Preferences → Windows Settings → Registry

Create registry items with the same key path as Step 3. Names are case-sensitive:

Value Name
Value Data
userName
%USERNAME%Expands to logged-in user
userEmail
%USERNAME%@yourdomain.comOptional. Falls back to Chrome profile email if not set.

Step 5: Apply and verify

  1. Close the Group Policy Editor
  2. On a test machine: gpupdate /force, then sign out and back in
  3. Open Chrome

Verify:

  • chrome://policy shows enrollmentToken, deviceName, and userName with values
  • chrome://extensions shows InvestigAItor as Installed by enterprise policy
  • The admin dashboard shows the device within a minute

Incognito and Guest mode

To ensure monitoring works in Incognito mode, add this policy:

Computer Configuration → Administrative Templates → Google Chrome
  → Extensions → Allowed types of apps and extensions in Incognito

Add the extension ID: ncibbcpcjhieaffkncaeemcfihlhkcdg

To prevent users from bypassing monitoring via Guest mode, disable it:

Computer Configuration → Administrative Templates → Google Chrome
  → Browser Guest Mode → Disabled

This removes the Guest option from Chrome's profile menu on all managed devices.

Edge deployment

Same process but use Microsoft Edge ADMX templates and the registry path HKLM\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\ncibbcpcjhieaffkncaeemcfihlhkcdg\policy.

Having issues? See the Troubleshooting page.