Deploy the extension with your RMM

# Lemhi AI Usage extension: install from the Chrome Web Store and Microsoft Edge Add-ons,
# and set this client's values. Writes registry policy only, then reads back what it wrote
# and checks whether the extension is installed and its hosts are reachable from this computer.
$ClientKey     = '<deployment key>'
$IngestBaseUrl = '<ingest base URL>'
$ComputerName  = $env:COMPUTERNAME

if ($ClientKey -cnotmatch '^lemhi_dk_[A-Za-z0-9_-]{43}\z') {
  Write-Output 'clientKey is not a Lemhi deployment key (expected 52 characters starting lemhi_dk_); copy it again from the Deployment tab'
  exit 1
}

$Browsers = @(
  @{ Name = 'Chrome'; Root = 'HKLM:\SOFTWARE\Policies\Google\Chrome';  Id = 'kkjkfiijligobjmfghkheppbpmbngicl'
     Data = 'Google\Chrome'; Store = 'https://clients2.google.com/service/update2/crx'
     Exe = @("$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
             "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
             "$env:SystemDrive\Users\*\AppData\Local\Google\Chrome\Application\chrome.exe") },
  @{ Name = 'Edge';   Root = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'; Id = 'kkijfgcaljdkipkaehbgkihkopbmigjm'
     Data = 'Microsoft\Edge'; Store = 'https://edge.microsoft.com/extensionwebstorebase/v1/crx'
     Exe = @("$env:ProgramFiles\Microsoft\Edge\Application\msedge.exe",
             "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe") }
)

# An HTTPS GET as this script's account with a 10 second timeout. Returns the HTTP status code,
# or the error class when no HTTP response arrived (for example NameResolutionFailure or Timeout).
$ProgressPreference = 'SilentlyContinue'
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
function Get-HttpsStatus($Uri) {
  try { return [int](Invoke-WebRequest -Uri $Uri -UseBasicParsing -TimeoutSec 10).StatusCode }
  catch {
    if ($_.Exception.Response) { return [int]$_.Exception.Response.StatusCode }
    if ($_.Exception.Status) { return [string]$_.Exception.Status }
    return $_.Exception.GetType().Name
  }
}

$Failed = $false
foreach ($b in $Browsers) {
  $list = Join-Path $b.Root 'ExtensionInstallForcelist'
  if (-not (Test-Path $list)) { New-Item -Path $list -Force | Out-Null }
  $entries = Get-ItemProperty -Path $list
  $names = @((Get-Item -Path $list).Property)
  $present = $names | Where-Object { (($entries.$_) -split ';')[0] -eq $b.Id }
  if (-not $present) {
    $max = ($names | Where-Object { $_ -match '^\d+$' } | ForEach-Object { [int]$_ } | Measure-Object -Maximum).Maximum
    New-ItemProperty -Path $list -Name ([string](1 + [int]$max)) -Value $b.Id -PropertyType String | Out-Null
  }

  $policy = Join-Path $b.Root "3rdparty\extensions\$($b.Id)\policy"
  if (-not (Test-Path $policy)) { New-Item -Path $policy -Force | Out-Null }
  New-ItemProperty -Path $policy -Name 'clientKey'     -Value $ClientKey     -PropertyType String -Force | Out-Null
  New-ItemProperty -Path $policy -Name 'computerName'  -Value $ComputerName  -PropertyType String -Force | Out-Null
  New-ItemProperty -Path $policy -Name 'ingestBaseUrl' -Value $IngestBaseUrl -PropertyType String -Force | Out-Null

  # Read back what was written. The key shows only its first 12 characters, as the Deployment tab does.
  $entries = Get-ItemProperty -Path $list -ErrorAction SilentlyContinue
  $entry = @((Get-Item -Path $list -ErrorAction SilentlyContinue).Property |
    Where-Object { (($entries.$_) -split ';')[0] -eq $b.Id }) | Select-Object -First 1
  $values = Get-ItemProperty -Path $policy -ErrorAction SilentlyContinue
  $key = [string]$values.clientKey
  $installed = @($b.Exe | Where-Object { Test-Path -Path $_ }).Count -gt 0
  $line = '{0}: forcelist entry {1}, key starts {2}, computer {3}, ingest {4}, {5}' -f $b.Name,
    $(if ($entry) { $entry } else { 'none' }), $key.Substring(0, [Math]::Min(12, $key.Length)),
    $values.computerName, $values.ingestBaseUrl,
    $(if ($installed) { 'browser installed' } else { 'browser not installed (the policy applies once it is installed)' })
  if (-not $entry -or $key -cne $ClientKey -or $values.computerName -cne $ComputerName -or $values.ingestBaseUrl -cne $IngestBaseUrl) {
    $Failed = $true
    $line += ', does not match what this script wrote'
  }
  Write-Output $line

  # Diagnostics. These print what they find and never fail the run: before a browser restart,
  # "not installed yet" is the expected answer.
  $folders = @(Get-ChildItem -Path "$env:SystemDrive\Users\*\AppData\Local\$($b.Data)\User Data\*\Extensions\$($b.Id)\*" -Directory -ErrorAction SilentlyContinue)
  $versions = @($folders | ForEach-Object { $v = $null; if ([version]::TryParse(($_.Name -split '_')[0], [ref]$v)) { $v } })
  $profiles = @($folders | ForEach-Object { $_.Parent.FullName } | Sort-Object -Unique).Count
  if ($versions.Count -gt 0) {
    Write-Output ('{0}: extension installed, version {1} ({2} profile{3})' -f $b.Name,
      ($versions | Sort-Object -Descending | Select-Object -First 1), $profiles, $(if ($profiles -eq 1) { '' } else { 's' }))
  } else {
    Write-Output "$($b.Name): extension not installed yet (installs when the browser next starts with this policy)"
  }

  $status = Get-HttpsStatus $b.Store
  if ($status -is [int]) { Write-Output "$($b.Name): store update host reachable" }
  else { Write-Output "$($b.Name): store update host NOT reachable: $status; allow it through your web filter" }
}

$status = Get-HttpsStatus "$($IngestBaseUrl.TrimEnd('/'))/healthz"
if ($status -eq 200) { Write-Output 'ingest reachable' }
elseif ($status -is [int] -and $status -ne 403) { Write-Output "ingest answered HTTP $status (the service, not your network); try again later" }
else { Write-Output "ingest NOT reachable: $(if ($status -is [int]) { "HTTP $status" } else { $status }); allow this host through your web filter and proxy" }

Write-Output 'This computer appears on the Deployment tab after its first check-in, within a few minutes of a browser starting with this policy in place.'
if ($Failed) { exit 1 }