Skip to content

Scoping policies to specific computers via Group Policy

You can control which PolicyClue policies apply on which computers by tagging each computer with one or more role labels via Chrome managed settings (Group Policy on Windows, MDM on macOS). Policies with matching roles apply on that computer; policies without any role scoping apply everywhere.

This is useful when your fleet is already segmented by Organisational Unit and you want the same segmentation to drive which policies fire where, without maintaining a second list in the PolicyClue portal.

How it works

Two pieces need to line up:

  1. On the computer: a Chrome managed setting called pclue_computer_roles carries a list of role labels (for example Finance, Engineering, Kiosk). Push this via GPO on the target Computer OU alongside the other extension settings.
  2. On the policy: in the portal's policy editor, fill in the Computer roles field with a comma-separated list of the same labels. Leave it empty to apply the policy on every computer.

At every site check the extension forwards the computer's role labels to the server. The server keeps a policy on this computer if either the policy has no roles configured (universal), or the computer's role list overlaps with the policy's role list.

Defining role labels

Roles are free-form strings you invent. Match them to how you already group your fleet (AD Organisational Units, MDM device groups, etc.). Typical examples: Finance, Engineering, Executives, Kiosk, Field-Sales.

Labels are case-insensitive on the server side but exact on the client, so keep the spelling consistent between the portal policy and the GPO value.

Tagging computers on Windows via Group Policy

  1. Open the GPO applied to the target Computer OU (for example Finance-Workstations).
  2. Under Computer Configuration → Preferences → Windows Settings → Registry, either edit the existing PolicyClue policy key or create a new registry item:
    • Hive: HKEY_LOCAL_MACHINE
    • Key path: Software\Policies\Google\Chrome\3rdparty\extensions\{extension_id}\policy
    • Value name: pclue_computer_roles
    • Value type: REG_MULTI_SZ (Multi-String Value)
    • Value data: one role label per line, for example: 
      Finance
Engineering
  3. Push the GPO. Devices refresh Chrome policy on the next scheduled cycle (roughly every 90 minutes) or immediately after gpupdate /force followed by a Chrome restart.

Computers in that OU will now match any portal policy that carries Finance or Engineering in its role list.

Per-user tagging (optional)

You can also push pclue_computer_roles under HKEY_CURRENT_USER (User Configuration → Preferences → Windows Settings → Registry) instead of / in addition to the Computer OU. This is useful when the same computer is shared and you want different role tags depending on who is logged in.

The value name and format are the same; only the hive changes. Chrome merges both into the extension's managed storage view.

Tagging on Microsoft Edge

The same value name works on Edge. Use the Edge-specific registry path:

Software\Policies\Microsoft\Edge\3rdparty\extensions\{extension_id}\policy

The extension ID differs per browser (the ID assigned by the Chrome Web Store vs. the Edge Add-ons store); use the ID that matches the extension version deployed on that browser.

Tagging on macOS via MDM

Add a pclue_computer_roles key with an array value to the same PolicyClue configuration profile that carries pclue_api_endpoint / pclue_auth_token / computer_name:

<key>pclue_computer_roles</key>
<array>
    <string>Finance</string>
    <string>Engineering</string>
</array>

Setting the roles on a policy in the portal

Open the policy in the portal. Below the Name field you'll find a Computer roles (optional) input. Type role labels comma-separated:

Finance, Engineering

Save. From now on the policy only applies on computers whose pclue_computer_roles list overlaps this input. Leaving the field empty makes the policy universal (applies on every computer).

Verifying on a client

Open chrome://policy/ (or edge://policy/) and filter for pclue_computer_roles. The value should show as a JSON array of your role labels. If it does not:

  • Confirm the device is domain-managed. The top of chrome://policy/ shows Managed by ... when it is.
  • Confirm the extension ID in the registry path matches the ID of the installed extension.
  • Run gpupdate /force, then fully close and restart the browser.

Notes

  • Role scoping only narrows the set of policies a computer receives. A computer without any roles configured sees only universal policies (those with an empty role list in the portal).
  • Because the roles ride on every check, an updated GPO takes effect on the next site visit after Chrome picks up the new value.
  • A user with local administrator rights on their device can rewrite the local registry and change what role tags Chrome reads. This is the same trust model as the extension's endpoint and token configuration.