Skip to main content

How to Silently Install and Activate the Extension on Windows Devices Using Active Directory (1/2)

Updated
[Notice: UI Terminology Update]
With recent updates, the term "Member" in the system has been changed to "User." If you still see "Member" in some parts of this help documentation, please read it as "User." For more details, please refer to this announcement.
Note: The screenshots in this article are currently taken from the Japanese version of the product. Some labels in the images may differ from the English interface.

Getting Started

To identify users (employees) and link them with the extension, you must write specific strings identifying the tenant and the user to the registry.
While the tenant identification string is a unique, fixed value for your organization, the user identification value is a user variable. Therefore, you need to configure it according to your environment.
The typical configuration methods are described below. Please choose one of the following methods, or another method suitable for your Active Directory (AD) environment.

A: The PC (domain) login ID is different from the local part of the email address (the left side of @), but the email address is registered in the "Email" attribute in AD.
Step 1. Write the Organization ID to the Registry + Step 2. Identify Individuals - Method A Configuration

B: The PC (domain) login ID is the same as the local part of the email address (the left side of @).
Step 1. Write the Organization ID to the Registry + Step 2. Identify Individuals - Method B Configuration

C: The PC (domain) login ID is different from the local part of the email address (the left side of @), and the email address is not registered in the "Email" attribute in AD.
Step 1. Write the Organization ID to the Registry + Step 2. Identify Individuals - Method C Configuration

D: You want to identify individuals on shared PCs where users do not log in with individual IDs.
(Users must log in to the browser using their organization's email address. If they log in with a personal email address or do not log in to the browser, they cannot be detected.)
Step 1. Write the Organization ID to the Registry only

Although you can use [Computer Configuration] = HKEY_LOCAL_MACHINE, the instructions below assume you are using User Configuration = HKEY_CURRENT_USER.

Step 1. Write the Organization ID to the Registry

  1. Go to [User Configuration] (Recommended) or [Computer Configuration] (if there are no shared PCs or if shared PCs use a common ID) > [Preferences] > [Windows Settings] > [Registry].
  2. Right-click and select [New] > [Registry Item] from the menu.
  3. Enter the following in the [New Registry Properties] window:
  • [Hive] (Keep default)
    • For User Configuration: HKEY_CURRENT_USER
    • For Computer Configuration: HKEY_LOCAL_MACHINE
  • [Key Path]
    • For Chrome: SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\moaklgcgokbgplldonjkoochhlefkbjf\policy
    • For Edge:
      SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\hjifncajikcdkhlofdjjlhcjoennmdfc\policy
  • [Value name] OrganizationKey
  • [Value data]: Copy and paste the Organization ID obtained from the Josys Admin Console

Step 2. Identify Individuals

A: Set the AD email address as a user variable and write the email address of that variable

If the user attributes in AD contain an email address (e.g., the mail attribute), you can use an LDAP query to write that attribute as an environment variable.

  1. Click [Preferences] > [Environment] > [New] > [Environment Variable].
  2. In the General tab, configure the following settings:
    ○ Action: Update
    ○ Select User Variable
    ○ Name: EMAIL
    ○ Value: %_EMAIL%
  3. In the Common tab, configure (check) the following settings, then click [Targeting].
    ○ Run in logged-on user’s security context
    ○ Item-level targeting
  4. Click [New Item] in the upper left, and select [LDAP Query].

  5. Configure the following values:

    ○ Filter: (&(objectClass=user)(sAMAccountName=%USERNAME%))
    ○ Binding: LDAP:
    ○ Attribute: mail (Assuming the email address is stored in the mail attribute)
                                      You can also use UserPrincipalName instead of mail.
    ○ Environment variable name: _EMAIL

  6. This allows you to set the AD attribute as an environment variable on the user side.
    After applying the GPO, log in to a target device with a target user and run the following in PowerShell to verify that the email address is set in the environment variable:

    echo $env:EMAIL
  7. From the GPO configuration screen,
    click [Preferences] > [Windows Settings] > [Registry] > [New] > [Registry Item].
  8. In the General tab, configure the following settings:
    ○ Action: Update
    ○ Hive: HKEY_CURRENT_USER
    ○ Key Path:
    　<Chrome>
    　Software\Policies\Google\Chrome\3rdparty\extensions\moaklgcgokbgplldonjkoochhlefkbjf\policy
    　<Edge>
    　Software\Policies\Microsoft\Edge\3rdparty\extensions\hjifncajikcdkhlofdjjlhcjoennmdfc\policy
    ○ Value name: UserEmail
    ○ Value data: %EMAIL% (References the environment variable configured earlier)
  9. Click Apply, and then click OK to close the window. The configuration is now complete.
    Proceed to Step 3: Apply the GPO.

B: Write USERNAME + @ + Domain

  1. From the GPO configuration screen, click [Preferences] > [Windows Settings] > [Registry] > [New] > [Registry Item].
  2. In the General tab, configure the following settings:
    ○ Action: Update
    ○ Hive: HKEY_CURRENT_USER
    ○ Key Path:
    　<Chrome>
    　Software\Policies\Google\Chrome\3rdparty\extensions\moaklgcgokbgplldonjkoochhlefkbjf\policy
    　<Edge>
    　Software\Policies\Microsoft\Edge\3rdparty\extensions\hjifncajikcdkhlofdjjlhcjoennmdfc\policy
    ○ Value name: UserEmail
    ○ Value data: %USERNAME%@testcorp.com 
                                          Replace the part after @ with your organization's email domain.
  3. Click Apply, and then click OK to close the window. The configuration is now complete.
    Proceed to Step 3: Apply the GPO.

C: Write USERNAME (COMPUTERNAME)

  1. Register the same string you will write to the registry (such as USERNAME or COMPUTERNAME) as the integration ID (IT Device ID) for each user (employee) in Josys.

  2. From the GPO configuration screen, click [Preferences] > [Windows Settings] > [Registry] > [New] > [Registry Item].
  3. In the General tab, configure the following settings:
    ○ Action: Update
    ○ Hive: HKEY_CURRENT_USER
    ○ Key Path:
    　<Chrome>
    　Software\Policies\Google\Chrome\3rdparty\extensions\moaklgcgokbgplldonjkoochhlefkbjf\policy
    　<Edge>
    　Software\Policies\Microsoft\Edge\3rdparty\extensions\hjifncajikcdkhlofdjjlhcjoennmdfc\policy
    ○ Value name: DeviceIdentity
    ○ Value data: For Computer (Device) Name ＞ %COMPUTERNAME%  
    　Value data: For User Name ＞ %USERNAME%
  4. Click Apply, and then click OK to close the window. The configuration is now complete.
    Proceed to Step 3: Apply the GPO.

Step 3: Apply the GPO

  1. Apply the newly created policy to your network.
    💡 For the initial test, we recommend targeting a specific group of devices or users rather than the entire domain.
  2. Return to the GPO console. Right-click the domain or OU where you want to apply the policy, and select [Link an Existing GPO...].
    💡 If using "Computer Configuration," computer objects must be included. If using "User Configuration," user objects must be included.

  3. Select the created Group Policy, click "OK," and close.

Once this is complete (and the policy has propagated), proceed to the silent installation process.

How to Silently Install and Activate the Chrome Extension on Windows Devices Using Active Directory (2/2)
How to Silently Install and Activate the Edge Extension on Windows Devices Using Active Directory (2/2)

Related articles