This post will talk about my latest PowerShell module BrowserExtensionReporting, which helps with reporting on installed browser extensions for users. Many security frameworks define that browser extensions should be allowed listed only, but following that requirement without understanding what is already out there is quite challenging. Hopefully, this PowerShell module can help with that initial (and why not ongoing) reporting of your browser extension estate.
The module is published to PowerShell Gallery and has no dependencies so installation is simple
Install-Module -Name BrowserExtensionReporting
This section will explore all the parameters of the only available function (Get-BrowserExtensionInfo)
If not specified, this parameter will default to all supported browsers currently (Chrome, Edge, and Firefox). Edge and Chrome have multiple entries for each channel (Beta, Canary, and Dev) because they store different channels in different folders, Firefox uses the same profile folder for all channels, and it controls at a profile level which profile is connected to each channel.
If a specific browser is required here are the possible values
Get-BrowserExtensionInfo -Browser Edge,Chrome
Get-BrowserExtensionInfo -Browser Edge,EdgeBeta,EdgeCanary,EdgeDev
Get-BrowserExtensionInfo -Browser Chrome,Firefox
If not specified, this parameter will default to currentuser, the user executing the function. Any other options must be run with a user that has administrative privileges (you cannot read other users’ files and folders without it).
The current options are:
|Combination of LocalUsers, VirtualUsers and EntraUsers
|All accounts under HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList with a SID of S-1-5-21-*
|All accounts under HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList with a SID of S-1-5-110-*
|All accounts under HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList with a SID of S-1-12-*
|The current user running the function.
|The active account logged on to a computer. This was created to support programmatically capturing users on Remote Sessions (such as Windows 365, AVD, and DevBox)
|Once selected, this option will prompt for a username and it should match the profile name.
Note: Note this parameter does not support multiple entries
Get-BrowserExtensionInfo -User LoggedOnUser
Get-BrowserExtensionInfo -User EntraUsers
Get-BrowserExtensionInfo -User Other
Please provide user name: **user1**
The main function has the option (turned off by default) to collect usernames (ProfileGaiaName) and e-mails (ProfileUserName) for profiles where the users signed in. For compliance reasons, harvesting such information might not always be a good idea. If the user has logged on with a personal account, their username and e-mail for that account will be exposed. To enable this function set the parameter to $true.
Exposing Login Info:
Hidding Login Info:
Note: Some properties might not show depending on which browser select. ExtensionInstalledByDefault and ProfileGaiaName are exclusive to Chromium browsers, so they will always show empty on Firefox.
Hope that was informative and thanks for reading.