Deploy-PimActivatorClient
PIM Activator: install the extension on a machine without Intune
Purpose
Installs the PIM Activator browser extension on this machine (Edge, Chrome or both) through local Chromium enterprise policy in the registry -- force-install, install source, extension settings and the tenant catalog -- for servers and machines without Intune; -Uninstall removes only what it wrote.
When to run it
On a server or a machine that is not managed by Intune, once (PIM Manager > Operations > PIM Activator > Servers shows the command with your tenant and app). Re-run to change the settings; -Uninstall to remove them.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | Local Administrator (elevated PowerShell) | this machine; only for -Scope Machine (HKLM, the default) | machine policy lives under HKLM. -Scope User (HKCU, the current user only) needs no elevation. |
| other | Delegated sign-in: Organization.Read.All, Application.Read.All (read only) | Microsoft Graph, for the first-party app Microsoft Graph Command Line Tools | ONLY when neither -TenantId + -ClientId nor -CatalogJsonPath is given: the tenant and the PIM Activator app are looked up live. The command PIM Manager shows passes both, so it signs in to nothing. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| this machine's registry | update | <HKLM or HKCU>\SOFTWARE\Policies\Microsoft\Edge and \Google\Chrome \ExtensionInstallForcelist: one row '<extension id>;<update URL>' in the slot already holding our id, else the lowest free slot; other rows carrying our id are removed | the browser installs and keeps the extension updated | Deploy-PimActivatorClient.ps1 -Uninstall (removes only our rows) | ||
| this machine's registry | update | ...\ExtensionInstallSources: one row with the update host pattern (https://<host>/*) | allows the install where a hardened baseline restricts install sources | -Uninstall (kept while another forcelist row still installs from that host) | ||
| this machine's registry | update | ...\ExtensionSettings: our entry (force_installed, runtime_allowed_hosts) merged into the organisation's dictionary -- their entries are kept | an extension update can never be silently disabled as a permission expansion | -Uninstall (takes only our id out) | ||
| this machine's registry | update | ...\ExtensionInstallAllowlist: one row with our id -- only with -WriteAllowlist | for environments that block every extension ('*' blocklist) | -Uninstall | ||
| this machine's registry | create | ...\3rdparty\extensions\<extension id>\policy\tenantCatalog (tenant name, tenant id, app client id, activation defaults; plus -AdditionalTenantsJson tenants) | the extension's 'Use centrally deployed' setup reads it | -Uninstall (removes the whole 3rdparty\extensions\<extension id> key) | ||
| this machine's registry | update | ...\3rdparty\extensions\<id>\policy\autoActivateMaxGroups (DWORD) for BOTH PIM Activator extensions (production and test) -- only with -AutoActivateMaxGroups (-1 removes it) | per-device cap on auto-activation, the same for production and test (as the Intune Remediation writes it) | re-run with -AutoActivateMaxGroups -1 | ||
| this machine's registry | update | ...\3rdparty\extensions\<id>\policy\bulkActivateConfirmThreshold (DWORD) for BOTH PIM Activator extensions -- only with -BulkActivateConfirmThreshold (-1 removes it) | per-device 'click again to confirm' threshold for bulk activation (as the Intune Remediation writes it) | re-run with -BulkActivateConfirmThreshold -1 | ||
| this machine's registry | remove | with -Uninstall: our forcelist / allowlist / install-source rows, our ExtensionSettings entry and the 3rdparty\extensions\<extension id> key -- nothing of the organisation's | removes the PIM Activator from this machine (the browser uninstalls it on its next start) | run the install again |
What it only reads
- this machine's current Edge / Chrome extension policies (so the organisation's own rows and settings are kept)
- only without -TenantId + -ClientId: the tenant (organization) and the PIM Activator app registration, by exact name or -ClientId
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Scope | no | Machine | Machine (HKLM, every user, needs elevation) or User (HKCU, the current user only). |
| -Browser | no | Both | Edge, Chrome or Both. |
| -Channel | no | Released | Released, or Test (the separate TEST extension id and update manifest). |
| -TenantId | no | With -ClientId: the tenant catalog is written from these values (no sign-in). | |
| -ClientId | no | Application (client) id of the PIM Activator app registration. Without it the app is looked up by exact -AppDisplayName (sign-in). | |
| -TenantName | no | PIM | The tenant name the users see in the extension. |
| -AdditionalTenantsJson | no | Optional: more tenants for the extension's tenant switcher (JSON array of name, tenantId, clientId). | |
| -DefaultJustification | no | Change in infrastructure | The justification the extension pre-fills (overrides the catalog's). |
| -DefaultDurationHours | no | 8 | The activation length the extension pre-fills, 1-24 hours (overrides the catalog's). |
| -AutoActivateMaxGroups | no | not set (left alone) | Per-device cap on auto-activation: 0 = off, N = at most N groups, -1 = remove the cap. |
| -BulkActivateConfirmThreshold | no | not set (left alone) | Per-device 'click again to confirm' threshold for bulk activation: 1-100, -1 = remove it. Both extensions. |
| -ActivationEndTime | no | not set (left alone) | Per-device end-of-day time 'HH:MM' (local time): every activation ends no later than this today; 'none' = remove it. Both extensions. |
| -Prefix | no | With -TenantId and -ClientId: list only groups whose names start with this text. | |
| -EntraPrefix | no | With -TenantId and -ClientId: list only Entra roles whose names start with this text. | |
| -AzurePrefix | no | With -TenantId and -ClientId: list only Azure roles whose names start with this text. | |
| -CatalogJsonPath | no | A tenant catalog JSON file to write instead of -TenantId/-ClientId or the live lookup. | |
| -SkipTenantCatalog | no | false | Write only the install policies, no tenant catalog. |
| -WriteAllowlist | no | false | Also write ExtensionInstallAllowlist (only where every extension is blocked). |
| -AppDisplayName | no | PIM Activator | Exact display name used to find the app when -ClientId is not given (must be unique). |
| -ExtensionId | no | eheocihmlppcophaeakmdenhgcookkab | The extension id; change it only for a fork. |
| -UpdateUrl | no | https://knudsenmorten.github.io/PIM4EntraPS/updates.xml | The update manifest the browser installs and updates the extension from (self-hosting). |
| -Uninstall | no | false | Remove only what this script wrote for the extension id. |
Preview with -WhatIf
Reads this machine's policies and prints every registry value it would set or remove (forcelist slot, install source, ExtensionSettings entry, tenant catalog, per-device limits). Nothing is written. A preview of -Scope Machine runs without elevation.
Undo
Deploy-PimActivatorClient.ps1 -Uninstall (same -Scope, -Browser and -Channel): removes only this script's rows, entries and keys; the browser removes the extension on its next start.
Network
It connects to: none when -TenantId and -ClientId are given (the command PIM Manager shows), login.microsoftonline.com, graph.microsoft.com -- only for the live lookup, knudsenmorten.github.io -- by the BROWSER afterwards, not by this script: the update manifest and the signed extension package (Chromium installs a package only when its signing key matches the extension id)
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/pim/Deploy-PimActivatorClient.ps1 -OutFile Deploy-PimActivatorClient.ps1
.\Deploy-PimActivatorClient.ps1To check the download first, compare its SHA-256 with the published one:
SHA-256 094dab2d43e03c05292b03efd63bfb2f13864be9eb0dc187c1d6f334f038b903
Checksums: SHA256SUMS.txt · Version 3.0.70
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Deploy-PimActivatorClient.ps1 -Full · Source: Deploy-PimActivatorClient.ps1
Every script, identity and permission for your security review: PIM Manager