AIDR - Remove Browser Extension v1.x.x - Uninstall the AIDR standalone extension

Remove AIDR Standalone Browser Extension v1.x.x

After you deploy and verify the Falcon Endpoint collector, remove the standalone AIDR browser extension from Chrome and Edge on managed endpoints. This completes the migration from the standalone browser collector to the Falcon Endpoint collector, which uses the Falcon browser extension.

note:

The Falcon browser extension supports only Google Chrome and Microsoft Edge. If you also deployed the standalone AIDR browser extension on Firefox, keep it installed.
The standalone AIDR extension automatically disables itself when the Falcon browser extension with the AIDR module is present. You can remove the standalone extension after verifying the Falcon Endpoint collector is active.

Requirements

Before removing the standalone extension, confirm that the Falcon Endpoint collector is working:
- The Falcon Endpoint collector is deployed and assigned to the target host groups. For setup steps, see Deploy .
- Events from the Falcon Endpoint collector appear in AIDR Findings with the FBEX (Falcon Browser Extension) tag. For verification steps, see Verify deployment .
The standalone AIDR browser extension v1.x.x is deployed on the same endpoints. To confirm which version is installed, open the AIDR extension from the browser toolbar.

Remove AIDR browser extension

Select the removal method that matches how you originally deployed the extension.

Chrome:
Edge:

Chrome

Chrome Enterprise

Remove extension

Log in to the Google Admin console. Click the main menu icon and go to Chrome browser > Apps & extensions.
Select the OU where the AIDR extension is deployed.
Click the Users & browsers tab.
Select the AIDR extension (gppamppofhecmnlhmhdobepbifmpafmp) in the App list.
Click the delete icon.
In Delete AIDR, click DELETE.

After enrolled browsers check in, Chrome removes the extension automatically.

Verify removal

In the Google Admin console, go to Chrome browser > Apps & extensions. Confirm that the AIDR extension no longer appears in the App list for the target OU.
On a target machine:
1. Restart the browser and go to chrome://extensions. Confirm that the AIDR extension is not listed.
2. Go to chrome://policy and click Reload policies. Confirm that no references to gppamppofhecmnlhmhdobepbifmpafmp appear under force-install or extension policy entries.

Jamf (macOS)

Remove extension

In Jamf, go to Computers > Configuration Profiles.
Click the configuration profile that manages the AIDR Chrome extension.
On the configuration profile page, under Options, expand Application & Custom Settings and click External Applications.
Choose one of the following options based on your configuration:
- If the profile manages only the AIDR extension and you want to keep it on specific machines, adjust its scope:
  1. Click Edit.
  2. Click Scope to adjust targets, limitations, and exclusions for the profile scope.
  3. Click Save.
  4. In Redistribution Options:
    1. Select Distribute to All.
    2. Click Save.
- If the profile manages only the AIDR extension and you want to remove it from all machines, delete the profile:
  1. Click Delete to remove the entire configuration profile.
  2. Click Delete to confirm.
- If the profile manages other extensions, remove only the AIDR payloads:
  1. Click Edit.
  2. Remove the force-install entry:
    1. Find the payload with com.google.Chrome preference domain.
    2. In Preference Domain Properties > ExtensionInstallForcelist, remove the entry containing the AIDR extension ID (gppamppofhecmnlhmhdobepbifmpafmp).
  3. Remove the extension settings payload:
    1. Find the payload with the preference domain:
      com.google.Chrome.extensions.gppamppofhecmnlhmhdobepbifmpafmp
    2. Delete this payload.
  4. Click Save.
  5. In Redistribution Options:
    1. Select Distribute to All.
    2. Click Save.

Verify removal

If you edited the profile rather than deleting it, review it in Jamf:

Verify that no remaining payloads reference the old extension ID (gppamppofhecmnlhmhdobepbifmpafmp), or that target machines are no longer included in the profile scope.
On a target machine:
1. Restart Google Chrome and go to chrome://extensions. Confirm that the AIDR extension is not listed.
2. Go to chrome://policy and click Reload policies. Confirm that no references to gppamppofhecmnlhmhdobepbifmpafmp appear under force-install or extension policy entries.
3. Verify that the old managed preferences file no longer exists:
```
find /Library/Managed\ Preferences -name "com.google.Chrome.extensions.gppamppofhecmnlhmhdobepbifmpafmp.plist" 2>/dev/null
```
  If the command returns no output, the old configuration has been removed.
tip:
To apply the profile update immediately without waiting for the next scheduled check-in, run this command on the target machine:
sudo jamf recon

Microsoft Intune (Windows)

Remove extension

Log in to Microsoft Intune at intune.microsoft.com.
Remove the force-install policy:
1. Go to Devices > Manage devices > Configuration > Policies.
2. Open the Settings Catalog policy that deploys the AIDR Chrome extension.
3. Expand Configuration settings.
4. Choose one of the following options based on your configuration:
  - If the profile manages only the AIDR extension, delete the profile.
    1. On the device configuration profile page, click Delete.
    2. Click OK to confirm deletion.
  - If the profile manages other extensions, edit the profile and remove the AIDR entry:
    1. Click Edit in Configuration settings.
    2. In Google > Google Chrome > Extensions, select the entry containing the AIDR extension ID:
      gppamppofhecmnlhmhdobepbifmpafmp
    3. Click Delete.
    4. Click Review + save.
    5. Click Save.
note:
Intune notifies online devices when a policy changes. The policy update typically applies within minutes. If a device is offline, the update applies at the next scheduled check-in, up to 8 hours.

To confirm a specific device received the update:
1. Go to Devices > All devices.
2. Select the device.
3. Click Sync.
Remove the configuration Platform Script:
1. Go to Devices > Manage devices > Scripts and remediations > Platform scripts.
2. Delete the Platform Script that configures the AIDR Chrome extension.

Clean up residual registry values by deploying a cleanup script. Copy the following script and save it as Remove-AIDR-Chrome-Extension.ps1.

Remove-AIDR-Chrome-Extension.ps1
$ErrorActionPreference = "Stop"
try {
  $extensionId = "gppamppofhecmnlhmhdobepbifmpafmp"

  # Remove force-install entry
  $forcelistPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
  $item = Get-Item -Path $forcelistPath -ErrorAction SilentlyContinue
  if ($item) {
      $item.GetValueNames() | ForEach-Object {
          if ($item.GetValue($_) -match [regex]::Escape($extensionId)) {
              Remove-ItemProperty -Path $forcelistPath -Name $_
          }
      }
  }

  # Remove extension configuration
  $configPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\$extensionId"
  if (Test-Path $configPath) {
      Remove-Item -Path $configPath -Recurse -Force
  }

  Write-Output "AIDR Chrome extension removed."
  Exit 0
} catch {
  Write-Error "Failed: $($_.Exception.Message)"
  Exit 1
}

Add a Platform Script:
1. Log in to Microsoft Intune at intune.microsoft.com.
2. Go to Devices > Manage devices > Scripts and remediations > Platform scripts.
3. Click + Add and select Windows 10 and later.
4. On the Add PowerShell script page:
  1. Basics > Name: Remove AIDR Chrome Extension
  2. Click Next.
  3. Script settings:
    1. Script location: Select the Remove-AIDR-Chrome-Extension.ps1 file.
    2. Run this script using the logged on credentials: No (run as System)
    3. Enforce script signature check: No
    4. Run script in 64-bit PowerShell host: Yes
  4. Click Next.
  5. Assignments: Add groups, users, or devices assigned to the same groups that had the AIDR extension.
  6. Click Next.
  7. Review + create: Review script configuration.
  8. Click Create.
note:
Platform scripts don't execute immediately. Registry changes can take additional time to appear after the script runs.
To trigger the script sooner on a target device, restart the machine or restart the Intune Management Extension service:
Restart-Service -Name IntuneManagementExtension
Allow a few minutes for the script to execute after the service restart.

Verify removal

In the Intune admin center, verify the cleanup script executed successfully:
1. Go to Devices > Manage devices > Scripts and remediations > Platform scripts.
2. Click the cleanup script name.
3. Verify that Device status and User status show Succeeded.
note:
Status reports update after each device check-in and can take several minutes to reflect the latest state. Wait for devices to check in before you review the results.
On a target machine:
1. Verify that the extension is no longer in the registry:
```
reg query "HKLM\SOFTWARE\Policies\Google\Chrome" /s /f "gppamppofhecmnlhmhdobepbifmpafmp"
```
  Expected output: End of search: 0 match(es) found.
2. Restart the browser and go to chrome://extensions. Confirm that the AIDR extension is not listed.
3. Go to chrome://policy and click Reload policies. Confirm that no references to gppamppofhecmnlhmhdobepbifmpafmp appear under force-install or extension policy entries.
tip:
To force the cleanup script to run immediately without waiting for the next device check-in, restart the Intune Management Extension service on the target machine:
Restart-Service IntuneManagementExtension

After you verify removal across target machines, delete the cleanup Platform Script from the Intune admin center.

Group Policy (Windows)

Remove extension

Open Group Policy Management Editor for the GPO that deploys the AIDR Chrome extension.
Remove the force-install entry:
1. Go to Computer Configuration > Policies > Administrative Templates > Google > Google Chrome > Extensions.
2. Double-click Configure the list of force-installed apps and extensions.
3. Click Show....
4. Choose one of the following options based on your configuration:
  - If the AIDR extension is the only entry:
    1. Click Cancel to close Show Contents.
    2. Select Not Configured or Disabled in Configure the list of force-installed apps and extensions.
    3. Click OK to close Configure the list of force-installed apps and extensions.
  - If other extensions are listed:
    1. Remove the entry containing the AIDR extension ID (gppamppofhecmnlhmhdobepbifmpafmp).
    2. Click OK to close Show Contents.
    3. Click OK to close Configure the list of force-installed apps and extensions.
Remove computer-level registry preference items:
1. Go to Computer Configuration > Preferences > Windows Settings > Registry.
2. Delete the registry items with key paths containing gppamppofhecmnlhmhdobepbifmpafmp (items for urlTemplate, registrationIdentity, hostname).
Remove user-level registry preference items:
1. Go to User Configuration > Preferences > Windows Settings > Registry.
2. Delete the registry items with key paths containing gppamppofhecmnlhmhdobepbifmpafmp (items for userId, userFullName).
Clean up residual registry values on client machines. GPO Registry Preferences don't automatically remove registry values already written to clients. Use GPO-native Delete action items to remove them.
1. Go to Computer Configuration > Preferences > Windows Settings > Registry.
2. Right-click and select New > Registry Item. Use these values in New Registry Properties:
  - Action: Delete
  - Hive: HKEY_LOCAL_MACHINE
  - Key Path:
    SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\gppamppofhecmnlhmhdobepbifmpafmp
  Leave all other fields empty. This deletes the entire key and all its subkeys.
3. Click OK.
4. Go to User Configuration > Preferences > Windows Settings > Registry.
5. Right-click and select New > Registry Item. Use these values in New Registry Properties:
  - Action: Delete
  - Hive: HKEY_CURRENT_USER
  - Key Path:
    SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\gppamppofhecmnlhmhdobepbifmpafmp
  Leave all other fields empty. This deletes the entire key and all its subkeys.
6. Click OK.

Apply policy

Domain-joined machines automatically refresh Group Policy every 90 minutes, with a random offset of up to 30 minutes. Computer Configuration settings also apply at startup, and User Configuration settings at logon.

To apply the updated policy sooner, choose one of the following Group Policy update methods:

Run Invoke-GPUpdate from a domain controller or an admin workstation with Remote Server Administration Tools (RSAT) to remotely trigger a refresh on target machines:
```
Invoke-GPUpdate -Computer "<target-machine-name>" -RandomDelayInMinutes 0 -Force
```
In the Group Policy Management console, right-click the target OU and select Group Policy Update. This creates a remote scheduled task on each computer in the OU, with up to a 10-minute random delay.
To test on a target machine, run:
```
gpupdate /force
```

Verify removal

On a target machine:
1. Restart the browser and go to chrome://extensions. Confirm that the AIDR extension is not listed.
2. Go to chrome://policy and click Reload policies. Confirm that no references to gppamppofhecmnlhmhdobepbifmpafmp appear under force-install or extension policy entries.
3. Verify that the extension is no longer in the registry:
```
Test-Path -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\gppamppofhecmnlhmhdobepbifmpafmp"
```
```
Test-Path -Path "HKCU:\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\gppamppofhecmnlhmhdobepbifmpafmp"
```
  Expected output: False for both.

After you confirm removal across target machines, remove the temporary Delete items from the GPO to keep the configuration clean.

Microsoft Edge

Jamf (macOS)

Remove extension

In Jamf, go to Computers > Configuration Profiles.
Click the configuration profile that manages the AIDR Edge extension.
On the configuration profile page, under Options, expand Application & Custom Settings and click External Applications.
Choose one of the following options based on your configuration:
- If the profile manages only the AIDR extension and you want to keep it on specific machines, adjust its scope:
  1. Click Edit.
  2. Click Scope to adjust targets, limitations, and exclusions for the profile scope.
  3. Click Save.
  4. In Redistribution Options:
    1. Select Distribute to All.
    2. Click Save.
- If the profile manages only the AIDR extension and you want to remove it from all machines, delete the profile:
  1. Click Delete to remove the entire configuration profile.
  2. Click Delete to confirm.
- If the profile manages other extensions, remove only the AIDR payloads:
  1. Click Edit.
  2. Remove the force-install entry:
    1. Find the payload with com.microsoft.Edge preference domain.
    2. In Preference Domain Properties > ExtensionInstallForcelist, remove the entry containing the AIDR extension ID (gppamppofhecmnlhmhdobepbifmpafmp).
  3. Remove the extension settings payload:
    1. Find the payload with the preference domain:
      com.microsoft.Edge.extensions.gppamppofhecmnlhmhdobepbifmpafmp
    2. Delete this payload.
  4. Click Save.
  5. In Redistribution Options:
    1. Select Distribute to All.
    2. Click Save.

Verify removal

If you edited the profile rather than deleting it, review it in Jamf:

Verify that no remaining payloads reference the old extension ID (gppamppofhecmnlhmhdobepbifmpafmp), or that target machines are no longer included in the profile scope.
On a target machine:
1. Restart Microsoft Edge and go to edge://extensions. Confirm that the AIDR extension is not listed.
2. Go to edge://policy and click Reload policies. Confirm that no references to gppamppofhecmnlhmhdobepbifmpafmp appear under force-install or extension policy entries.
3. Verify that the old managed preferences file no longer exists:
```
find /Library/Managed\ Preferences -name "com.microsoft.Edge.extensions.gppamppofhecmnlhmhdobepbifmpafmp.plist" 2>/dev/null
```
  If the command returns no output, the old configuration has been removed.
tip:
To apply the profile update immediately without waiting for the next scheduled check-in, run this command on the target machine:
sudo jamf recon

Microsoft Intune (Windows)

Remove extension

Log in to Microsoft Intune at intune.microsoft.com.
Remove the force-install policy:
1. Go to Devices > Manage devices > Configuration > Policies.
2. Open the Settings Catalog policy that deploys the AIDR Edge extension.
3. Expand Configuration settings.
4. Choose one of the following options based on your configuration:
  - If the profile manages only the AIDR extension, delete the profile.
    1. On the device configuration profile page, click Delete.
    2. Click OK to confirm deletion.
  - If the profile manages other extensions, edit the profile and remove the AIDR entry:
    1. Click Edit in Configuration settings.
    2. In Microsoft Edge > Extensions, select the entry containing the AIDR extension ID:
      gppamppofhecmnlhmhdobepbifmpafmp
    3. Click Delete.
    4. Click Review + save.
    5. Click Save.
note:
Intune notifies online devices when a policy changes. The policy update typically applies within minutes. If a device is offline, the update applies at the next scheduled check-in, up to 8 hours.

To confirm a specific device received the update:
1. Go to Devices > All devices.
2. Select the device.
3. Click Sync.
Remove the configuration Platform Script:
1. Go to Devices > Manage devices > Scripts and remediations > Platform scripts.
2. Delete the Platform Script that configures the AIDR Edge extension.

Clean up residual registry values by deploying a cleanup script. Copy the following script and save it as Remove-AIDR-Edge-Extension.ps1.

Remove-AIDR-Edge-Extension.ps1
$ErrorActionPreference = "Stop"
try {
  $extensionId = "gppamppofhecmnlhmhdobepbifmpafmp"

  # Remove force-install entry
  $forcelistPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"
  $item = Get-Item -Path $forcelistPath -ErrorAction SilentlyContinue
  if ($item) {
      $item.GetValueNames() | ForEach-Object {
          if ($item.GetValue($_) -match [regex]::Escape($extensionId)) {
              Remove-ItemProperty -Path $forcelistPath -Name $_
          }
      }
  }

  # Remove extension configuration
  $configPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\$extensionId"
  if (Test-Path $configPath) {
      Remove-Item -Path $configPath -Recurse -Force
  }

  Write-Output "AIDR Edge extension removed."
  Exit 0
} catch {
  Write-Error "Failed: $($_.Exception.Message)"
  Exit 1
}

Add a Platform Script:
1. Log in to Microsoft Intune at intune.microsoft.com.
2. Go to Devices > Manage devices > Scripts and remediations > Platform scripts.
3. Click + Add and select Windows 10 and later.
4. On the Add PowerShell script page:
  1. Basics > Name: Remove AIDR Edge Extension
  2. Click Next.
  3. Script settings:
    1. Script location: Select the Remove-AIDR-Edge-Extension.ps1 file.
    2. Run this script using the logged on credentials: No (run as System)
    3. Enforce script signature check: No
    4. Run script in 64-bit PowerShell host: Yes
  4. Click Next.
  5. Assignments: Add groups, users, or devices assigned to the same groups that had the AIDR extension.
  6. Click Next.
  7. Review + create: Review script configuration.
  8. Click Create.
note:
Platform scripts don't execute immediately. Registry changes can take additional time to appear after the script runs.
To trigger the script sooner on a target device, restart the machine or restart the Intune Management Extension service:
Restart-Service -Name IntuneManagementExtension
Allow a few minutes for the script to execute after the service restart.

Verify removal

In the Intune admin center, verify the cleanup script executed successfully:
1. Go to Devices > Manage devices > Scripts and remediations > Platform scripts.
2. Click the cleanup script name.
3. Verify that Device status and User status show Succeeded.
note:
Status reports update after each device check-in and can take several minutes to reflect the latest state. Wait for devices to check in before you review the results.
On a target machine:
1. Verify that the extension is no longer in the registry:
```
reg query "HKLM\SOFTWARE\Policies\Microsoft\Edge" /s /f "gppamppofhecmnlhmhdobepbifmpafmp"
```
  Expected output: End of search: 0 match(es) found.
2. Restart the browser and go to edge://extensions. Confirm that the AIDR extension is not listed.
3. Go to edge://policy and click Reload policies. Confirm that no references to gppamppofhecmnlhmhdobepbifmpafmp appear under force-install or extension policy entries.
tip:
To force the cleanup script to run immediately without waiting for the next device check-in, restart the Intune Management Extension service on the target machine:
Restart-Service IntuneManagementExtension

After you verify removal across target machines, delete the cleanup Platform Script from the Intune admin center.

Group Policy (Windows)

Remove extension

Open Group Policy Management Editor for the GPO that deploys the AIDR Edge extension.
Remove the force-install entry:
1. Go to Computer Configuration > Policies > Administrative Templates > Microsoft Edge > Extensions.
2. Double-click Control which extensions are installed silently.
3. Click Show....
4. Choose one of the following options based on your configuration:
  - If the AIDR extension is the only entry:
    1. Click Cancel to close Show Contents.
    2. Select Not Configured or Disabled in Control which extensions are installed silently.
    3. Click OK to close Control which extensions are installed silently.
  - If other extensions are listed:
    1. Remove the entry containing the AIDR extension ID (gppamppofhecmnlhmhdobepbifmpafmp).
    2. Click OK to close Show Contents.
    3. Click OK to close Control which extensions are installed silently.
Remove computer-level registry preference items:
1. Go to Computer Configuration > Preferences > Windows Settings > Registry.
2. Delete the registry items with key paths containing gppamppofhecmnlhmhdobepbifmpafmp (items for urlTemplate, registrationIdentity, hostname).
Remove user-level registry preference items:
1. Go to User Configuration > Preferences > Windows Settings > Registry.
2. Delete the registry items with key paths containing gppamppofhecmnlhmhdobepbifmpafmp (items for userId, userFullName).
Clean up residual registry values on client machines. GPO Registry Preferences don't automatically remove registry values already written to clients. Use GPO-native Delete action items to remove them.
1. Go to Computer Configuration > Preferences > Windows Settings > Registry.
2. Right-click and select New > Registry Item. Use these values in New Registry Properties:
  - Action: Delete
  - Hive: HKEY_LOCAL_MACHINE
  - Key Path:
    SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\gppamppofhecmnlhmhdobepbifmpafmp
  Leave all other fields empty. This deletes the entire key and all its subkeys.
3. Click OK.
4. Go to User Configuration > Preferences > Windows Settings > Registry.
5. Right-click and select New > Registry Item. Use these values in New Registry Properties:
  - Action: Delete
  - Hive: HKEY_CURRENT_USER
  - Key Path:
    SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\gppamppofhecmnlhmhdobepbifmpafmp
  Leave all other fields empty. This deletes the entire key and all its subkeys.
6. Click OK.

Apply policy

To apply the updated policy sooner, choose one of the following Group Policy update methods:

Run Invoke-GPUpdate from a domain controller or an admin workstation with Remote Server Administration Tools (RSAT) to remotely trigger a refresh on target machines:
```
Invoke-GPUpdate -Computer "<target-machine-name>" -RandomDelayInMinutes 0 -Force
```
In the Group Policy Management console, right-click the target OU and select Group Policy Update. This creates a remote scheduled task on each computer in the OU, with up to a 10-minute random delay.
To test on a target machine, run:
```
gpupdate /force
```

Verify removal

On a target machine:
1. Restart the browser and go to edge://extensions. Confirm that the AIDR extension is not listed.
2. Go to edge://policy and click Reload policies. Confirm that no references to gppamppofhecmnlhmhdobepbifmpafmp appear under force-install or extension policy entries.
3. Verify that the extension is no longer in the registry:
```
Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\gppamppofhecmnlhmhdobepbifmpafmp"
```
```
Test-Path -Path "HKCU:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\gppamppofhecmnlhmhdobepbifmpafmp"
```
  Expected output: False for both.

After you confirm removal across target machines, remove the temporary Delete items from the GPO to keep the configuration clean.

Next steps

After removal, monitor AIDR logs to confirm events continue to flow through the Falcon Endpoint collector.

For more information, see Visibility & Monitoring .

note:
Removing the extension doesn't affect data previously collected by the standalone browser extension.
Optionally, remove unused browser collector policies and collector registrations from the AIDR console. Removing these doesn't affect existing logs.

For more information, see Policy Configuration and Browser Collectors .
If you need to reinstall the standalone browser extension, see Browser Collectors .

Remove AIDR Standalone Browser Extension v1.x.x​

Requirements​

Remove AIDR browser extension​

Chrome​

Chrome Enterprise​

Jamf (macOS)​

Microsoft Intune (Windows)​

Group Policy (Windows)​

Microsoft Edge​

Jamf (macOS)​

Microsoft Intune (Windows)​

Group Policy (Windows)​

Next steps​

Remove AIDR Standalone Browser Extension v1.x.x

Requirements

Remove AIDR browser extension

Chrome

Chrome Enterprise

Jamf (macOS)

Microsoft Intune (Windows)

Group Policy (Windows)

Microsoft Edge

Jamf (macOS)

Microsoft Intune (Windows)

Group Policy (Windows)

Next steps