Deploy-PimActivatorHybrid
PIM Activator: deploy to machines without Intune (local policy or AD Group Policy)
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Deploys the PIM Activator browser-extension policy (force-install, install source, extension settings and a multi-tenant catalog) to on-premises or standalone machines without Intune: as a JSON artifact, as this machine's local policy (HKLM), or as an Active Directory Group Policy Object.
When to run it
When admins work from domain-joined or standalone machines that Intune does not manage (often MSPs with many tenants): -Target DomainGpo once per domain, -Target LocalGpo per standalone machine, -Target Json to inspect the values first. Re-run after changing the tenant config file.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | Local Administrator (elevated PowerShell) | this machine; -Target LocalGpo and DomainGpo | local machine policy lives under HKLM. -Target Json needs no elevation. |
| other | Active Directory: create and edit Group Policy Objects (Group Policy Creator Owners, or delegated edit on the GPO) and link GPOs on the OU | the domain; -Target DomainGpo only | creates or updates the GPO and optionally links it to -LinkToOu. Needs the Windows GroupPolicy module (RSAT, part of Windows). |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| file system | create | -Target Json: the managed-config JSON artifact at -OutputPath (default next to the script) | inspect or import the exact values | delete the file | ||
| this machine's registry (HKLM) | update | -Target LocalGpo: under SOFTWARE\Policies\Microsoft\Edge and \Google\Chrome -- ExtensionInstallForcelist row, ExtensionInstallSources row, our ExtensionSettings entry merged into the organisation's (with -MinimumVersion as minimum_version_required), and 3rdparty\extensions\<extension id>\policy\ tenantCatalog, bulkActivateConfirmThreshold (-BulkThreshold), autoActivateMaxGroups (-AutoActivateMaxGroups); stray rows carrying our id are removed | the browser installs the extension and the users get the tenant catalog -- the same values the Intune path writes | remove those values (Deploy-PimActivatorClient.ps1 -Uninstall -Scope Machine removes the same rows) | ||
| Active Directory | create | -Target DomainGpo: Group Policy Object -GpoName (default '[PimActivator] client settings') when it does not exist | carries the policy to the domain's machines | delete the GPO in Group Policy Management | ||
| Group Policy Object -GpoName | update | the same registry policy values as LocalGpo (Set-GPRegistryValue); our stray values are removed (Remove-GPRegistryValue); slots used by other GPOs on this machine are never taken | the same configuration as the Intune path | delete the GPO, or remove the values in its Computer Configuration > Preferences / Administrative Templates | ||
| Active Directory OU -LinkToOu | create | a link of the GPO to that OU -- only with -LinkToOu (otherwise the GPO stays unlinked) | applies the policy to the machines in that OU | remove the link in Group Policy Management |
What it only reads
- the tenant config JSON file (validated before anything is written)
- -Target LocalGpo: this machine's current extension policies
- -Target DomainGpo: the GPO's current values and the policy in effect on this machine (slots another GPO owns)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantConfigJsonPath | yes | Path (local or UNC) to the per-tenant config JSON (up to 25 tenants: name, tenantId, clientId, optional defaults). Alias -ConfigUncPath. Without it the script prints its usage. | |
| -Target | no | Json | Json (artifact only), LocalGpo (this machine's HKLM policy) or DomainGpo (an AD Group Policy Object). |
| -OutputPath | no | pim-activator-hybrid-managed-config.json next to the script | -Target Json: where the artifact is written. |
| -GpoName | no | [PimActivator] client settings | -Target DomainGpo: the GPO to create or update. |
| -LinkToOu | no | -Target DomainGpo: distinguished name of an OU to link the GPO to. Omitted: the GPO is left unlinked. | |
| -Browser | no | Both | Both, Edge or Chrome. |
| -Channel | no | Released | Released, or Test (the TEST extension id and update manifest). |
| -DefaultJustification | no | Overrides the pre-filled justification on every tenant entry. | |
| -DefaultDurationHours | no | Overrides the pre-filled activation length (1-24 hours) on every tenant entry. | |
| -MinimumVersion | no | Optional minimum extension version; an older install is disabled until it updates. | |
| -BulkThreshold | no | Optional tenant-wide bulk-activate confirmation threshold (1-100). | |
| -AutoActivateMaxGroups | no | Optional per-device cap on auto-activation (0 = off). | |
| -ActivationEndTime | no | Optional end-of-day time 'HH:MM' (device local time): every activation ends no later than this today. | |
| -MaxTenants | no | 25 | The most tenants the config may hold. |
| -ExtensionId | no | eheocihmlppcophaeakmdenhgcookkab | The extension id; change it only for a fork. |
| -UpdateUrl | no | https://knudsenmorten.github.io/PIM4EntraPS/updates.xml | The update manifest the browsers install the extension from. |
| -SourcePattern | no | https://knudsenmorten.github.io/* | The ExtensionInstallSources pattern. |
Preview with -WhatIf
Validates the config and prints every value it would write: the artifact path (Json), every HKLM value it would set or remove (LocalGpo, no elevation needed for the preview), or the GPO it would create, its values and the OU link (DomainGpo). Nothing is written.
Undo
Json: delete the file. LocalGpo: Deploy-PimActivatorClient.ps1 -Uninstall -Scope Machine (removes the same rows) or delete the values. DomainGpo: delete the GPO (or its link) in Group Policy Management; machines drop the policy at their next Group Policy refresh.
Network
It connects to: none to the internet -- the config file (local or UNC share) and, for DomainGpo, the domain controller, knudsenmorten.github.io -- by the BROWSERS afterwards, not by this script: the update manifest and the signed extension package
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager