Deploy Doppelgänger to your fleet

Every method below sets one Chrome policy, ExtensionInstallForcelist, to:

ocnmklcdlgoancopbnnkehndjaiomhke;https://clients2.google.com/service/update2/crx

Chrome then installs Doppelgänger from the Chrome Web Store and keeps it updated, and people can't turn it off or remove it. It has no settings to push.

If you already force-install extensions, add the line above to that list. To find it, open chrome://policy on a managed machine: the Source of ExtensionInstallForcelist says where the list is set ("Cloud" is the Google Admin console, "Platform" is your MDM or Group Policy). Chrome reads one list, from the source highest in its order, and policy for the whole machine from an MDM outranks the Google Admin console's policy for the signed-in user. Chrome then uninstalls every extension that only the losing list force-installed. A profile that lists Doppelgänger alone therefore removes everything the Google Admin console installs, a company password manager included, and chrome://policy marks its list "Warning, Conflict". To keep the list in both places, the MDM copy has to carry every extension in the console's list, and each later change has to be made in both: on machines your MDM manages, Chrome reads only the MDM's list.

macOS: Jamf, Kandji, Mosyle, Intune and others

Create a custom configuration profile for the com.google.Chrome domain, scoped to computers, with these keys:

<key>ExtensionInstallForcelist</key>
<array>
  <string>ocnmklcdlgoancopbnnkehndjaiomhke;https://clients2.google.com/service/update2/crx</string>
</array>
<key>PasswordProtectionWarningTrigger</key>
<integer>1</integer>
  • Jamf Pro: Computers → Configuration Profiles → New → Application & Custom Settings → Upload.
  • Intune: Devices → macOS → Configuration → Create → Templates → Custom.
  • Miradore: Management → Configuration profiles → Add → macOS → Advanced (custom), and paste a complete profile whose com.google.Chrome payload holds these keys → Create. Then tick it → Deploy → pick the devices. A deployment stays Queued until the Mac checks in; on our test Mac it had stayed Queued for an hour, and a restart installed it.

Windows: Intune

Devices → Windows → Configuration → Create → Settings catalog. Search for "Configure the list of force-installed apps and extensions" (Google Chrome → Extensions), enable it, and add the line above. Intune ships Chrome's settings in its catalog, so there is nothing to import.

Windows: Group Policy

With Chrome's ADMX templates installed: Computer Configuration → Administrative Templates → Google → Google Chrome → Extensions → "Configure the list of force-installed apps and extensions" → Enabled, and add the line above.

Google Workspace (Chrome Browser Cloud Management)

Admin console → Devices → Chrome → Apps & extensions → Users & browsers → Add (+) → Add Chrome app or extension by ID → paste the ID → Installation policy: Force install.

Password-reuse warnings

PasswordProtectionWarningTrigger set to 1 makes Chrome warn whenever someone types a protected password on a site you haven't approved, whatever the page looks like. Whatever a phishing page looks like, it still has to receive the password, and this is the check that sees it there. The warning comes after the password is typed, so it limits the damage rather than preventing it: the person knows at once and can change it.

Which password is protected depends on where Chrome sees it typed:

  • Google Workspace: nothing more to set. With no login pages listed, Chrome protects the Google password typed at accounts.google.com.
  • Microsoft 365, or a single sign-on page such as Okta or ADFS: list the page your staff type the password on, and where to change it, in the same payload:
<key>PasswordProtectionLoginURLs</key>
<array>
  <string>https://login.microsoftonline.com/common/oauth2/v2.0/authorize</string>
</array>
<key>PasswordProtectionChangePasswordURL</key>
<string>https://mysignins.microsoft.com/security-info/password/change</string>

Chrome compares these addresses exactly, path included, ignoring only what follows ?. https://login.microsoftonline.com on its own matches nothing, because no password is typed on that bare address. The address above is where office.com sends people to sign in; to find yours, sign in from the app your staff use and copy the address bar up to the ?. Listing pages replaces the accounts.google.com default. On Windows, Google's admin help says these two apply only on machines joined to Active Directory.

Registration-date checks

Doppelgänger's one network request asks a domain's registry, over RDAP, when the domain was registered: only for a site asking for a password that it questions, and for Gmail senders it doesn't know. It is always on, and there's no switch for it in the extension: only an administrator can turn it off, with this policy. To set it for everyone, use the extension's own policy, domainAge (true or false); people then can't change it.

  • macOS: a custom settings payload for the preference domain com.google.Chrome.extensions.ocnmklcdlgoancopbnnkehndjaiomhke with <key>domainAge</key><false/> (Jamf: Application & Custom Settings; Intune: a custom profile).
  • Windows: the DWORD value domainAge = 0 under HKLM\Software\Policies\Google\Chrome\3rdparty\extensions\ocnmklcdlgoancopbnnkehndjaiomhke\policy (Group Policy or Intune).
  • Linux: a JSON file in /etc/opt/chrome/policies/managed/ holding {"3rdparty": {"extensions": {"ocnmklcdlgoancopbnnkehndjaiomhke": {"domainAge": false}}}}.
  • Google Admin console: on Doppelgänger's page under Apps & extensions, the policy JSON {"domainAge": {"Value": false}}.

chrome://policy lists it under Doppelgänger once applied.

Pair it with

  • Passkeys or security keys. A relayed sign-in passes SMS codes, authenticator codes and push approvals straight through. The browser offers a passkey only on the real address, so a relay can't use it.
  • Gmail: "Protect against spoofing of employee names." Admin console → Apps → Google Workspace → Gmail → Safety → Spoofing and authentication. It flags mail whose sender name matches someone in your directory but comes from outside your domains.
  • Google Calendar: "Add invitations to Calendar" set to "Invitations from known senders." Admin console → Apps → Google Workspace → Calendar → Advanced settings. Invitations from strangers then arrive by email only.
  • Microsoft Entra ID P2: the "Attacker in the Middle" risk detection, with a Conditional Access policy that acts on user risk.

Checking it worked

Open chrome://policy on a managed machine: ExtensionInstallForcelist lists the line and PasswordProtectionWarningTrigger shows 1, both with status OK. chrome://extensions shows Doppelgänger as installed by your organization. If ExtensionInstallForcelist shows "Warning, Conflict", another source sets a list too: see the note on existing lists at the top.