Technical Tip: Verifying if FortiClient Web Filter Browser Extension is force installed by FortiClient, or is it from other third-party

[btan]

Description	This article describes how to verify if FortiClient Web Filter Browser Extension is force installed by FortiClient, or is it from other third-party.
Scope	FortiClient v7.0, v7.2 and above. When 'Enable Web Browser Plugin for Web Filtering' is already DISABLED in FortiClient EMS Endpoint profile, but FortiClient Web Filter Browser Extension is still remain installed in endpoints.
Solution	Open Registry Editor, navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome Select  Chrome, on the right side, see the ExtensionSettings key. If the Web Filter extension is forced installed (can be via EMS or GPO), it will have below similar value: {"mbdegapampkgaclohepfibppdhongjgh":{"installation_mode":"force_installed","update_url":"https://clients2.google.com/service/update2/crx"}} Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge. For Edge, the ExtensionSettings key will have below similar value: {"ckhgbbanigpkebahlfehgaegmepacdeo"{"installation_mode":"force_installed","update_url":"https://edge.microsoft.com/extensionwebstorebase/v1/crx"}} If the above registries exist, the WF extension may be force-installed by GPO. Open a Windows Command prompt, run below command: GPRESULT /Z >"%USERPROFILE%\Desktop\rsop.txt" Open the rsop.txt in the Desktop to identify any GPO being pushed that may result in this force installation. If there is no GPO detected (example below), check with other third-party endpoint management tool, for example Intune, and look for below extension ID in the configuration: mbdegapampkgaclohepfibppdhongjgh --> Chrome ckhgbbanigpkebahlfehgaegmepacdeo --> Edge If this extension ID appears anywhere in the third-party tool, proceed to remove or disable it: