How to remove a Google Chrome extension "Installed by enterprise policy"?

Google Chrome extension "Installed by enterprise policy" - how to remove?

This removal guide shows how to remove a Google Chrome extension that was "Installed by enterprise policy". Note that recently, there is a rise in adware infections, and in many cases, these potentially unwanted programs (PUPs) install on users' Internet browsers disguised as legitimate extensions. Commonly, potentially unwanted applications are bundled with free software downloaded from the Internet, the installation of which, is often a consequence of not paying close attention to the installation steps.

To avoid inadvertent adware or PUP installation, Internet users should always install freeware choosing the 'Custom Installation' option rather than 'Typical Installation' - and be sure to opt-out of any changes to your Internet browser settings. Also, disallow installation of any additional software. In this removal guide I will demonstrate how to remove the "Coupon Server" Google Chrome extension that is marked as "Installed by enterprise policy". I chose this extension simply as an example, however, this removal guide is generic and will help you to remove any Chrome extension that is marked as installed by enterprise policy.

To check the Google Chrome extensions: Click on the bars icon (top right corner of Google Chrome), select 'Tools' and click 'Extensions'.

Checking Google Chrome extensions list

Here is an example of a Chrome extension that is marked as "Installed by enterprise policy" (it is greyed-out, and therefore, users are unable to disable or remove it):

Google Chrome extension "Installed by enterprise policy" example

When dealing with "Installed by enterprise policy" Google Chrome extensions, first check for any recently-installed software within your operating system's 'Add/remove programs'. In some cases, uninstalling this software will also eliminate the associated Internet browser extension.

Windows 10 and Windows 8 users:

Right-click in the lower left corner of the screen, in the Quick Access Menu select "Control Panel". In the opened window choose "Uninstall a Program." Look for recently added software, select the entry and click Uninstall.

Windows 7 users:

Click "Start" ("Windows Logo" in the bottom left corner of your desktop), choose "Control Panel". Locate "Programs and Features". Look for recently added software, select the entry and click Uninstall.

Windows XP users:

Click "Start", choose "Settings" and click "Control Panel". Locate and click "Add or Remove Programs". Locate "Programs and Features". Look for "recently added software, select this entry, and click Remove.

Uninstalling potentially unwanted applications via Control Panel

After uninstalling the unwanted software, check your Internet browser extensions. If you continue to observe unwanted entries in your Google Chrome extensions list, continue with the removal instructions.

Firstly, you need to make a note of the ID of the unwanted "Installed by enterprise policy" extension. You will need this in later removal steps to verify the ID of an extension. Click on the bars icon (top right of the Google Chrome), select "Tools" and click on "Extensions", select "Developer Mode". 

Checking the id number of the Google Chrome extension

To remove the "Installed by enterprise policy" Chrome extension, you firstly need to close Google Chrome:

Close Google Chrome

Right click on the Google Chrome icon and choose "Close window".

Close any runing Google Chrome browsers

After closing Google Chrome, remove the registry entries of the "Installed by enterprise policy" extension:

In Windows XP - Click Start, Run.

Start, run in Windows XP

In the opened window type "regedit".

regedit Windows XP

In Windows 7 - Click Windows Logo (Start), in the "Search Programs and Files" field, type "regedit" and press Enter.

Windows 7 regedit

In Windows 10 - Click the Windows logo (Start) and type “regedit”, looks in the best match section and click on “regedit”.

windows 10 regedit

In the opened Registry Editor click "Edit" and select "Find...".

Finding the registry entries of the "Installed by enterprise policy" extension

In the opened window paste the ID of the "Installed by enterprise policy" Chrome extension which you are trying to remove and click "Find next" button.

Finding the registry entries of the "Installed by enterprise policy" Google Chrome extension step 2

Remove the registry key matching the Data value of the "Installed by enterprise policy" extension's ID (right click on the registry key and select "Delete"):

Deleting the registry entry of an "Installed by enterprise policy" extension

Confirm that you want to remove the registry entry by clicking "Yes" button.

Confirm value delete

After removing the registry entry of the "Installed by enterprise policy" Chrome extension, remove the associated files. To do this, Open "My Computer" and navigate to "C:\Users\YOUR USER NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions". Remove the directory matching the ID of the "Installed by enterprise policy" Chrome Extension.

You can access your AppData directory by typing %USERPROFILE% (Windows XP) or %localappdata% (Windows 7 and Windows 8),  in the Run dialog box.

"Installed by enterprise policy" Google Chrome extension files removal

Navigate to C:\Windows\System32\GroupPolicy\Machine (or C:\Windows\System32\GroupPolicy\User) folder and remove the file named Registry.pol

Removing registry.pol file

Finally open Google Chrome and check the extensions list. The "Installed by enterprise policy" extension should now be removed.

"Installed by enterprise policy" Chrome extension removed

Tasia Hester

I'm having trouble finding the installed enterprise policy on the registry editor that was installed by Minneapolis Public Schools website when I recovered my account on Monday October 22 and when I deleted my username thes1701@gmail.com and changed it back to thes1701@mpsedu.org and my password back to th0529 on my computer and that's how school extensions popped up and can't be disabled on my computer, I did not ask for school extensions to pop up. Are there any other ways to get rid of the installed enterprise policy off my computer? Tasia Hester

John Moruzzi

dude, how do I delete this extension called "wonderful weather" because its a violation of google policies, that I need to remove.
but how do I do it???!!
also, I have NO idea how it got into my browser

vladimir febrian

You have to find more than 1 of that ids sometimes there are several ids of that malware in the registry. Just delete them one by one and all of the problems will be solved

Caroline Cruz

Thanks for the post......it was very helpful. Keep updating the more blogs.

Ravi Sharma

I have deleted the registry from regeit but when I tried to deleted from system 32 there no such folder as group policy please reply me as soon as possible and the extension is furniture guru

Wendi

So I'm posting this because your instructions came up first on the list. Hopefully it will help others, did this by going through Webroot support:

HOW TO DELETE THE WEBROOT CHROME EXTENSION INSTALLED BY ENTERPRISE

So logs indicate that Webroot is uninstalled already but if the extension is still there, we usually do recommend a full uninstall including removal of all Webroot related files and registry.

Open Chrome and find the extension ID in 3 dots at top right in Chrome, More Tools, Extensions and clicking on the Details of the Webroot Extension and copy the extension ID, paste it into notepad for later. It will be a similar alphabetical string like this:
kjeghcllfecehndceplomkocgfbklffd

Make sure that Chrome is closed and remove the following (they may or may not all be there):
C:\Program Files (x86)\Webroot\WRSA.exe
C:\Program Files\Webroot\WRSA.exe
C:\ProgramData\WRData
C:\Windows\System32\WRusr.dll
C:\Windows\SysWOW64\WRusr.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WRkrn
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WRSVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wrUrlFlt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WRSVC
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WRkrn
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\WRkrn
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\WRSVC

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\WRkrn
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\WRSVC
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\WRData

Find and delete in the Registry (regedit.exe) all instances of the extension ID you found in Chrome. Copy it and paste it into Edit-Find, then keep finding all of them by using Find Next, there are at least 3 of them.

Restart your computer and then delete the file C:\Windows\System32\drivers\WRkrn.sys

Start Chrome, the extension will be gone

Subhash chandra bose

It worked for me...
Thanks a lot

Omar Syarif

Please help me, there's a new extension called Gadget Deals, take a look at it, i'm frustrated by this stupid extension.. please

kachexo

someone plz help, okay i have the newest windows and i was trying to down load a simple beat maker and it was working then i opened google and it had no name on the search bar. it had booking, amazon, gear best, aliexpress and lots of another boring sites i dont use. im only 15 and stressed a little. i know computers very well but all i can find about this thing is its name 'CryptoTokenExtension' i have tried to reset and debug it using a trusted malware but im getting nothing!!!!!!!

Mountain Guardian

To remove this malware from your computer...

Find and delete scthost.exe in the syswow64 folder, easiest way is to simply press "control alt delete" and find scthost, it will likely be running under your local user name, right click on the process and select "open file location" which open a new window showing the file likely within the syswow64 file folder, then end "process tree" on the scthost in the "task manager". Delete the file "scthost.exe" at the "file location"and then open notepad and type something anything into it and save it into the syswow64 directory or whichever directory the file was running from, with the name "scthost.exe"..

Then open a windows search directory and type "regedit" and select the "regedit" from the list.

Once into the registry editor look just to the right of the "file" tab and open the "edit" tab, look at the bottom of the drop down list under the "edit" tab for ""find"" click on ""find"" and type, "ActiveTrak" then hit the "enter" key to start the search. When you find a file with ActivTrak in it go to the folder containing it and Rename it with the same first 2 letters followed by "RENAME" and just leave the rest of the name the same as it was originally, easier to come back and find later if need be. To search through the rest of the registry simply go back up to the "edit" tab and drop down and look just below the "find" for the "find next", click on "find next" and it will search until it finds the next entry. Once you have done this to all files with ActivTrak in them then repeat the same search for "Birch Grove" and do the same with these files as you did for the ActivTrak files.

This effectively removes and stops activtrac on your computer. As I have found and noted before, somehow Malwarebytes does not recognize ActivTrak as malware, so you have to be on the watch and remove it yourself. Malwarebytes will catch and remove what ActivTrak loads onto your computer though, but without removing the ActivTrak software your computer simply starts reinstalling all the crap all over again if you do not remove or disable the ActivTrac and Birch Grove installers in the registry.

Never trust a company that creates malware to "uninstall" their malware, that is not how they make money.

The above method worked quite well for me, best of luck to anyone else dealing with this malware problem..

Matthew Sorg

There's this app on my Chromebook called securely that allows my school to access your account look at everything you do and change anything! long story short. my school is stalking everybody. this is on a Chromebook which will not let me use the software. any other suggestions?

Sofija Miric

thank you so much

TUI787

TRIGGERD

Alex

I have a chrome book how do i get rid of it

omer

Thanks a lot,
it worked.

zardd

Works, finnaly remove adware, and i will change every password

Nythepegasus

I did. It eventually stopped installing itself after I searched in those directories. Sorry I didn't see this 3 months ago.

Brianna Watson

Please never call me anything that isn't "Brianna" or "Bri." I hate guys who think they can get away with calling all girls "cute" names. Its irritating.

jun kuang

Thank u so much

Ashif Babu

SAME PROBLEM SWEET :)

Yasithan

Thank you very much, it worked for me.

Kurt

Worked for me

Pradip Nevarekar

now i have got about 15 registries. so which one i have to delete for extention named "always weather"?
or deleting all registries will cause any damage to other file?

Pradip Nevarekar

i could not find the registry and "match whole string only" check box is also unchecked.
please give solution.

Prakash Divya

it says "unable to delete all specified value"

Brianna Watson

I HAVE NO FREAKING REGISTRY EDIT! AND I'M STUCK WITH THIS STUPID "ALWAYS WEATHER" APP THAT KEEPS GIVING ME AD POP-UPS! I CAN'T REMOVE IT AND THERE IS NO REGISTRY EDIT ON MY WINDOWS 10 COMPUTER!!! I JUST WANT THE GOD DANG FILE FOR THIS!!!!

Chris Trevelyan

I had an issue with some kind of "weather" Chrome extension that would not allow me to uninstall. Instead it said "Installed by enterprise policy". Fortunately yours was the first site I came across and it has worked perfectly.
Thanks

bluelust

Thank you. I finally got rid of the tabs 2 grid adware on my browser with this method.

Martim

TY

Saikat Das

it worked perfectly....thank you very much

JazzDude

You sir, are awesome... Thanks

Kenny Akinde

OMG thank you so much

Will

There is no way to change the registry on a chromebook, at least not that we know of. Please explain better.

keyce

Worked great! THanks! I tried many other instructions before yours to no avail. Got rid it that pesky History Open extension

Jubs

Remove from regedit, the archives about the extensions (finded at ..\AppData\Local\Google\Chrome\User Data), and execute command prompt as admin and try this:

Type:

rd /S /Q "%WinDir%\System32\GroupPolicyUsers"

Press Enter.

Type:

rd /S /Q "%WinDir%\System32\GroupPolicy"

Press Enter.

Type:

gpupdate /force

Press Enter.

Idk what worked, so try it all ;)

Nick Ando

thank you so much!

Tomas Meskauskas

1) Open the Command Prompt by clicking the start menu button and typing "command prompt". Right click the "Command Prompt" result and select "Run as Administrator":

2) Execute the following commands:

rd /S /Q "%WinDir%\System32\GroupPolicyUsers"

rd /S /Q "%WinDir%\System32\GroupPolicy"

gpupdate /force

After performing these actions, you can proceed with further removal steps for this adware.

Nick Ando

at first it was removed, but as soon as i start chrome again the extension gets added back! can anyone help?

Constandt W Van Wyk

I went through all the steps upto App Data\Local\Google\Chrome\User Data\Default\Extensions. There was however no entry to delete. I proceeded with the steps after this and when I checked the Extension was not removed. I uninstalled and reinstalled Google Chrome and the entry was missing.

Burak Özdemir

i got some extension without a name.
it just says its from the company and tha it cant be removed.
I removed the entry in the registry by searching for the ID
but the next step didnt work, as there was no folder with the name of the ID for that add. in my system32 folder there is also no GroupPolicy folder, only "GroupPolicyUser" but that folder was empty already.
I so basically, i removed the registry entry and thats it. I also ran adware cleaner, as well as the latetest version of malwarebyte (14 days premium atm) deleted lots of stuff, but some are still there, like this extension.
I want to get rid of it, can someone help me?

DK

Hey guys! (FOR MACOS)

I have had this problem over the last couple of weeks on my iMac,

There is a simple fix - you simply go to your profile settings on system preferences.

You will see an unsigned profile, you just press the minus icon to remove it, then reload chrome and you will be golden!

Hope this helps!

Trevor Curtis

were you able to eventually delete the plugin doing this? i have tried this but I may be doing something wrong

Sabannim

please which app did you uninstall in your control panel ?
i have same problem too. cookies control, but i cant find any suspicious app to uninstall.

Nythepegasus

I know this may be irrelevant now, but here goes any way..
ATTENTION TO MAC USERS:
If you cant remove the virus extension, check your System Preferences/Profiles. It may be there, and if not, go to '~/Library/Application\ Support/Google/Chrome/' and search it's ID. Then delete all files. There may also be a '/scripts/' folder in your root directory, delete that. I found all this out, while trying to delete the demon extension... Hope this helps!

Haley

It was all succesful until I got to C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default and I can't find the "extensions" file. Could someone please help me?

Manish Rana

damn i installed windows 20 times and searched internet 3 f****** years for this solution....you are god man...i dont never know how to thank you bro...i installed every god damn anti virus and every damn malwarebytes too but this chrome extension "Installed by enterprise policy" never did go until today...i only can say now god will reward u bro tomas he will...

Manish Rana

u must close chrome and then follow instructions

Vinay Mohan Das

Thanks Tomas..this was really useful...

mukund

this is great I searched so many pages and installed so many useless malware removers. NOTHING worked. But your step by step process worked perfectly. Thanks a lot.

கரிவாலன்

kudos! it worked 100% for me for the extension 'Cookies control'