"Installed by enterprise policy" (fake) - How to remove

The ‘‘Installed by enterprise policy’’ warning refers to a browser (Google Chrome) extension that you don’t have the right to remove. It was either installed by your administrator, or by malware. Enterprise group policy is great for administrators to manage the extensions of employees, students, or members of an organization. But cybercriminals and crooks abuse it to install malware and keep it rooted in. That’s when “installed by enterprise policy” is a sign that your device’s security has been breached.

“Installed by enterprise policy” (fake) is a sign of malware:

Type of threat	Browser hijacker.
Consequences of an infection	Can’t delete potentially malicious extensions, private information is at risk, malicious ads and scams are shown.
Delete malware	Delete malicious files and programs, use anti-malware scanners (SpyHunter for PC, Combo Cleaner for Mac, Malwarebytes, etc.).
Remove “Installed by enterprise policy” (fake) pop-up and get rid of unwanted extensions	Contact your administrator if your computer is managed, use the Chrome policy removal tool, delete files and settings associated with the policy, delete settings that protect the extensions, uninstall the unwanted extensions.

About ‘‘Installed by enterprise policy’’ (the fake one)

You might find an unfamiliar browser extension that you cannot remove because the “Remove” button is grayed out or missing. You could be getting warnings like “Your browser is managed by an organization” and “Extension installed by enterprise policy”. These warnings should mean that your school, job, or organization manages your browser. For example, this could happen if you’re borrowing your computer from your job. They could be trying to block certain websites, track what you do online, block ads, or get you a spellchecker.

However, the ‘‘Installed by enterprise policy’’ warning can show up on a malicious extension, as well. ‘‘Installed by enterprise policy’’ (fake) appears if a malicious extension was installed by

If the ‘‘Installed by enterprise policy’’ (fake) message shows up when looking at a browser extension, that extension must have been installed by malware. There could be a few reasons why. Browser extensions can be pretty powerful:

• Some can ready everything that you do on your browser, including your passwords and your credit card number when you type it. Encryption doesn’t matter because the evil extension can capture this data before it’s sent out. For this, the extension needs permission to read and change some or all websites that you visit.
• Some extensions inject ads into webpages. Many of those ads are dangerous. These extensions also require permission to read and change websites.
• Cryptocurrency mining extensions can steal your processing power. Cryptojackers were banned from the Chrome Web Store in 2018, but cybercriminals may find ways around that.
• Click fraud and cookie stuffing extensions. These ad fraud extensions are used by cheating ad-networks, publishers, and affiliates to steal money from advertisers by lying to them. The victims are used as proxies – they get unwanted cookies downloaded on their device and their computer is used to click on ads in the background.

Besides the ‘‘Installed by enterprise policy’’ message, you may also see pop-ups telling you that your browser is “Managed by your organization” and that the browser extension in “Installed by your administrator”. If your computer is your personal one (not owned by your employer, school, or anything), that pop-up is another sign of a malware infection. SearchMine is a common example.

Malicious extensions can be hard to find out, but when you do find them, you should remove them as quickly as possible. The abuse of the ‘‘Installed by enterprise policy’’ constraint stops you from doing that.

How to remove ‘‘Installed by enterprise policy’’ (fake) extensions

Remove malware

You can’t delete the extension by clicking on its icon, going to the Web Store, or by going to chrome://extensions. You need to remove the policy that’s protecting the extension. But first of all, you may want to get rid of any malware that’s on your device. Otherwise, it might prevent you from removing the extensions and mess with your settings. Just use whatever anti-malware scanner that you trust, like SpyHunter for Windows, Combo Cleaner for Mac OS, Malwarebytes, or others. Once that’s done, you can get to removing the fake ‘‘Installed by enterprise policy’’.

Automatic removal

First, try the Chrome policy remover. That seems to have worked for some people in the Google Support forums. Here is a direct download link for WIndows and for Mac.

This is not an official tool by Chrome and it can trigger false-positive detections by some security programs (pretty common for tiny projects and scripts), but it has helped a lot of people. Since the manual options for removing “Installed by enterprise policy” are risky and kind of complicated, the policy remover script might be the best choice.

Manual removal

Alternatively, you can do this manually. Be careful with deleting files as some of them are important settings. It might help you to create a restore point (Windows, Mac OS) so that if you break anything, you can recover.

To know which extension has which ID, open the extensions page in your browser (go to chrome://extenssions) and turn on the Developer mode switch. That’ll let you see the IDs of your extensions and recognize the associated files and settings on your device.

Windows

If you’re a Windows user, there’s a way to get rid of “Installed by enterprise policy” (fake) extensions by editing your registry. Editing your registry is usually a bad idea and you should leave these settings alone. But sometimes it’s the only way to fix or change something. There’s an article by How-To Geek that has the instructions. It also has instructions on how to delete group policies on your computer. But like it says, if your computer belongs to a network that manages these policies, this is futile and you need to contact your administrator.

Basically, you need to open Registry Editor, go to Edit, Find, and paste in the extension ID that you saw on the chrome://extensions page. The registry editor will find the keys associated with that ID and you need to delete the values by right-clicking them and choosing “Delete”.

Again, please be very careful and make backups before this. The registry is important and very powerful. In the worst cases, messing with it can brick the computer.

Mac OS

Now, if you’re on a Mac, things are a bit different. You probably have some Profiles that malware put on your Mac. Open System Preferences and see if Profile Manager is there. If your Mac isn’t being managed by an organization, it’s possible that malware created a Profile to stop you from removing it. The removal instructions are similar to those of FocusProvide, an adware extension.

Close Chrome. Force quit it to be sure. Open Finder, Go, Go to Folder. Type in “~Library/Application Support” (might not appear right away, so be patient) or “Library/Application Support”. Open Google, Chrome, Profile, Extensions. There, you need to find the unwanted extension and delete the associated folder. Then, open Chrome again and remove the extension.

Manual removal of unwanted extensions

How to remove '‘Installed by enterprise policy’’ (fake) using Windows Control Panel

Many hijackers and adware like "Installed by enterprise policy" (fake) install some of their components as regular Windows programs as well as additional software. This part of malware can be uninstalled from the Control Panel. To access it, do the following.

• Start→Control Panel (older Windows) or press Windows Key→Search and enter Control Panel and then press Enter (Windows 8, Windows 10).
• Choose Uninstall Program (if you don't see it, click in the upper right next to "View by" and select Category).
• Go through the list of programs and select entries related to '‘Installed by enterprise policy’’ (fake) . You can click on "Name" or "Installed On" to reorder your programs and make "Installed by enterprise policy" (fake) easier to find.
• Click the Uninstall button. If you're asked if you really want to remove the program, click Yes.
• In many cases anti-malware programs are better at detecting related parasites, thus I recommend installing Spyhunter to identify other programs that might be a part of this infection.

How to remove '‘Installed by enterprise policy’’ (fake) from macOS

Delete "Installed by enterprise policy" (fake) from your applications.

1. Open Finder.
2. In the menu bar, click Go.
3. Select Applications from the dropdown.
4. Find the '‘Installed by enterprise policy’’ (fake) app.
5. Select it and right-click it (or hold the Ctrl and click the left mouse button).
6. In the dropdown, click Move to Bin/Trash. You might be asked to provide your login password.

TopRemove malicious extensions from Internet Explorer

• Press on the Gear icon→Manage Add-ons.
  
• Go through Toolbars and extensions. Remove everything related to "Installed by enterprise policy" (fake) and items you do not know that are made not by Google, Microsoft, Yahoo, Oracle or Adobe.
  
• Close the Options.

(Optional) Reset your browser’s settings

If you are still experiencing any issues related to '‘Installed by enterprise policy’’ (fake), reset the settings of your browser to its default settings.

• Press on the Gear icon->Internet Options.
  
• Choose the Advanced tab and click on the Reset button.
  
• Select a “Delete personal settings” checkbox and click on the Reset button.
  
• Click on the Close button on the confirmation box, then close your browser.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

TopRemoving "Installed by enterprise policy" (fake) from Chrome

• Click on the menu button on the top right corner of a Google Chrome window. Select “Settings”.
  
• Click “Extensions” on the left menu bar.
• Go through the extensions list and remove programs you do not need, especially similar to '‘Installed by enterprise policy’’ (fake). Click on the trash bin icon next to "Installed by enterprise policy" (fake) or other add-ons you want to remove.
  
• Press on the “Remove” button on the Confirmation window.
  
• If unsure, you can disable them temporarily.
  
• Restart Chrome.

(Optional) Reset your browser’s settings

If you are still experiencing any issues related to '‘Installed by enterprise policy’’ (fake), reset the settings of your browser to its default settings.

• Click on Chrome’s menu button (three horizontal lines) and select Settings.
  
• Scroll to the end of the page and click on the Reset settings button.
  
• Click on the Reset button on the confirmation box.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

TopRemoving "Installed by enterprise policy" (fake) from Firefox

• Click on the menu button on the top right corner of a Mozilla window and select the “Add-ons” icon (or press Ctrl+Shift+A on your keyboard).
  
• Go through Extensions and Addons list, remove everything '‘Installed by enterprise policy’’ (fake) related and items you do not recognise. If you do not know the extension and it is not made by Mozilla, Google, Microsoft, Oracle or Adobe then you probably do not need it.
  

(Optional) Reset your browser’s settings If you are still experiencing any issues related to "Installed by enterprise policy" (fake), reset the settings of your browser to its default settings.

• Click on the menu button on the top right corner of a Mozilla Firefox window. Click on the Help button.
  
• Choose Troubleshooting Information on the Help menu.
  
• Click on the Reset Firefox button.
  
• Click on the Reset Firefox button on the confirmation box. Mozilla Firefox will close and change the settings to default.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

How to remove "Installed by enterprise policy" (fake) from Microsoft Edge:Top

• Click on the menu button on the top right corner of a Microsoft Edge window. Select “Extensions”.

• Go through the extensions list and remove programs you do not need, especially similar to '‘Installed by enterprise policy’’ (fake). Click on the "Remove" icon next to "Installed by enterprise policy" (fake) or other add-ons you want to remove.

• Press on the “Remove” button on the Confirmation window.

• If unsure, you can disable them temporarily.

• Restart Microsoft Edge.

TopRemoving '‘Installed by enterprise policy’’ (fake) from Safari (Mac OS X)

• Click on the Safari menu.
• Choose Preferences.
  
• Click on the Extensions Tab.
• Click on the Uninstall button near the "Installed by enterprise policy" (fake). Remove all other unknown or suspicious entries too. If you are not sure whether you need the extension or not, you can simply uncheck the Enable check-box to disable the extension temporarily.
  
• Restart Safari.

(Optional) Reset your browser’s settings

If you are still experiencing any issues related to '‘Installed by enterprise policy’’ (fake), reset the settings of your browser to its default settings.

• Click on the Safari menu on the top left corner of the screen. Select Reset Safari.
  
• Select which options you want to reset (usually all of them come preselected) and click on the Reset button.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.