Remove a Browser Extension Policy

Deactivating or deleting a browser extension enforcement policy does NOT remove enforcement from your endpoints. Extensions blocked by policy stay blocked until you run the matching cleanup policy.

What happens when you deactivate or delete a policy

Privilege Manager enforces browser extension policies by writing managed settings to each browser's own enterprise policy surface on the endpoint:

  • Windows: ExtensionSettings value under HKLM\SOFTWARE\Policies\Google\Chrome, \Microsoft\Edge, and \Mozilla\Firefox

  • macOS: ExtensionSettings key in /Library/Managed Preferences/com.google.Chrome.plist, com.microsoft.Edge.plist, and org.mozilla.firefox.plist

Enforcement is delivered as a scheduled job. When you deactivate or delete a browser extension policy, Privilege Manager stops sending that job to the agent, so the agent stops applying the policy. The managed settings written by the last run, however, remain on the workstation.

Until they are cleared:

  • Extensions blocked by the policy remain blocked, and users cannot reinstall them.

  • If the policy used Allow List mode, extensions that are not on the list continue to be rejected.

  • Browsers continue to display the Managed by your organization indicator.

To return endpoints to an unmanaged state, run the cleanup policy for the platform.

Running the cleanup policy

Privilege Manager includes one cleanup policy per platform. Both are inactive by default and are read-only, so you enable and target them rather than editing them.

Platform

Location in the console

Windows

Computer group | Scheduled Jobs |
At the Create Scheduled Job dialog, select Client Command: Browser Extension Cleanup Script (Windows)

macOS

Computer group | Scheduled Jobs |
At the Create Scheduled Job dialog, select Client Command: Browser Extension Cleanup Script (macOS)

To remove enforcement from a computer group:

  1. Deactivate or delete the browser extension enforcement policy that is applied to the computer group.

  2. Open the computer group including the endpoints you want to clear and create the Scheduled Job (from Running the cleanup policy).

  3. Set the cleanup job to Active and save it. Optionally, adjust the job to run on a schedule.

  4. Wait for the agents in that group to receive the job or trigger the job on demand from an agent to clear a single endpoint immediately.

  5. Verify the settings were cleared on a representative endpoint, using the commands below.

  6. Deactivate the cleanup policy once the endpoints in scope are clear.

Verify on a Windows endpoint (run in an elevated command prompt). Each command should report that the value cannot be found:

reg query "HKLM\SOFTWARE\Policies\Google\Chrome" /v ExtensionSettings

reg query "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v ExtensionSettings

reg query "HKLM\SOFTWARE\Policies\Mozilla\Firefox" /v ExtensionSettings

Verify on a macOS endpoint. No ExtensionSettings entry should appear in the output:

plutil -p "/Library/Managed Preferences/com.google.Chrome.plist"

plutil -p "/Library/Managed Preferences/com.microsoft.Edge.plist"

plutil -p "/Library/Managed Preferences/org.mozilla.firefox.plist"

Then confirm in the browser itself. Quit the browser completely.

Things to know about the cleanup policy

  • The cleanup job runs when it first arrives on an agent.

  • By default, it does not run on a recurring schedule. If you deactivate a cleanup policy and later reactivate it, it will not run again automatically, because the job already exists on the agent. To run it again, trigger it on demand from the agent.

  • Offline agents run the job when they next check in.

  • Endpoints that are powered off or disconnected when the cleanup job is triggered will run it on their next check-in with the server.

  • A browser that was already open when cleanup ran keeps using the policy it read at launch. Fully quit and relaunch it, or use Reload policies on the browser's policy page, before concluding that cleanup did not work.

What cleanup does not do

Cleanup restores the browser to an unmanaged state. It does not undo what happened while the policy was in force.

  • It does not reinstall extensions that were removed.

  • It does not restore extension data or settings that were lost when an extension was removed.

  • It does not affect extensions your policy allowed.

Delinea recommends informing users before you change or remove an extension policy. Extensions disappear without warning, and users will not know they can reinstall them until you tell them the policy is gone.