enable Google Chrome policies otherwise only available with Active Directory

Question

There are a number of settings for Google Chrome which are applied as "policies". Under the hood, these are registry entries, typically located at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome. These policies are nominally designed to be enabled by Group Policy in an Active Directory environment (using ADM or ADMX files). Many of them work whether the computer is joined to a domain or not; presumably Chrome is just reading the registry value.

However, some policies only work when the computer is joined to Active Directory or "or Windows 10 Pro or Enterprise instances that enrolled for device management" (see link). Since the policy configuration values are ultimately just registry entries, then Chrome must be going out of its way to check if the computer is in Active Directory.

What I want to know, is there a way to deceive Chrome about the computer's Active Directory membership, or some way to otherwise convince Chrome to honor these policies regardless?

Answer 1

I have found, or rather "created" a solution. I don't recommend this, but it has worked.

Here's some background. Google Chrome restricts certain policies to computers which are domain members. I have not found an explicit reason for this, but the gist I get from reading documentation and notes suggests that this is a security precaution, as if a domain administrator has magical security powers. Chrome checks for domain membership by using the IsOS function exported by the SHLWAPI dll. The DLL is imported into "chrome.dll", which is typically located in a directory like c:\Program Files (x86)\Google\Chrome\Application\75.0.3770.80\chrome.dll.

It is possible to apply a binary patch to chrome.dll to redirect calls to IsOS to another function exported by SHLWAPI. A good match I have found is "ChrCmpIA" which will always return true given the arguments which are otherwise passed to IsOS. chrome.dll imports IsOS by ordinal (rather than by name) - IsOS has an ordinal of 437, and ChrCmpIA has an ordinal of 587. An ordinal of 437, as stored in the DLL looks like this 0xb5,0x01,0x00,0x00,0x00,0x00,0x00,0x80 . It can be replaced with 0x4b,0x02,0x00,0x00,0x00,0x00,0x00,0x80 . As of version 75, Chrome has two ordinal exports of 437, only the first should be patched. A program like HxD can do this without too much trouble. I've used this on Chrome 75.0.3770.80 (64-bit), as installed by the enterprise MSI package; it may work on other versions too (as this recipe does not use hard-coded addresses).

Standard disclaimers - Back up your chrome.dll first (or be prepared to reinstall). Don't do this, except for "educational purposes". Use this strategy at your own risk; there is a slight possibility of data loss, being fired, deportation and revocation of citizenship, or even influenza.

Answer 2

You could:

• Spin up a Linux VM.
• Configure a SAMBA to act as a Domain controller.
• Join your Windows PC to that domain

I don't think you would even need to leave the domain controller running. It would remain joined even when the VM is off.

SAMBA CONFIG: https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller

Answer 3

A reduced version of such options seems to be available also for computers that are not connected to Active Directory.

For the policy given as example, one can find a similar option in chrome://settings under Advanced > Reset and clean up > Clean up computer, called "Find harmful software", that comes with a "FIND" button and with absolutely no documentation on what it does. This setting is reachable directly via chrome://settings/cleanup, with a sub-option for "Report details to Google about harmful software, system settings, and processes that were found on your computer during this cleanup".

Pressing the FIND button will launch a long process with only the message of "Checking for harmful software…", with, again, absolutely no information on what exactly it does, nor any way to cancel it. In my case it ended with the message of "No harmful software found".

Conclusion: The difference between stand-alone and Active Directory computers seems to be only that the scan is automatic and periodic for the second but manual for the first. But I wouldn't count on this malware scan to be as extensive as that done by an antivirus product.

For more information, see the article
Remove Malware and Other Harmful Software Using Google Chrome.