Beta: One-step policy deployment using Windows and Intune

Credential Risk Detection, AI Phishing Alerts, and Credential Risk Alerts are available to organizations with Credential Protection.

If you have Credential Protection and are deploying the Dashlane browser extension, you can deploy the Credential Protection features at the same time:

• Credential Risk Detection
• AI Phishing Alerts
• Credential Risk Alerts

This guide covers how to deploy the risk detection policy and silently deploy the Dashlane extension in a single PowerShell script through Intune, without modifying the user’s browser autofill settings. This streamlined process handles policy and extension deployment in a single step, rather than the standard two-step process.

Although Credential Protection features are most beneficial when rolled out to your entire organization, you can start with a smaller group (or just yourself) during setup and extend it to more employees anytime. To add more employees, update the groups included in your policy deployment.

Add employees to the policy

Process overview

Estimated time to complete: 15 minutes

Prerequisites

Make sure you have the appropriate access needed to set up Credential Protection features:

• Admin access to a Dashlane account with Credential Protection
• Admin access to Microsoft Intune on Windows
• Permission to deploy policies to devices using Intune

If you prefer, watch the Windows + Intune step-by-step video

One-step deployment

In the Dashlane Admin Console, start the setup:

1. Log in to the Dashlane browser extension and open the Admin Console
2. Under Configurations, select Policy Deployment with Extension.

3. On the Deployment page, select Start setup.

   

4. On the Setup page, select Try Beta to see the policy deployment guide.

   

5. Select the Intune option and the browsers you're deploying to. Ensure your selection is accurate before downloading the script so your file is created correctly.

   

6. Select Download. Your device automatically downloads a script file so you can apply the Credential Protection policy to your deployment software. After the file downloads, open the Intune app.

In Intune, add the new policy:

1. Open Intune and select the following in order:
   • Devices
   • Scripts and Remediations
   • Platform scripts
   • Add

   • Windows 10 or later

     

2. Enter a name for the policy. For example, “Dashlane Credential Protection - One-step deployment”.
3. Select Next. You're prompted to select the file you downloaded.

4. Select No for the remaining three options on the screen, then select Next.

   

5. On the next page, select Add Groups. Then select the boxes next to the groups you want to deploy to, the policy, and the configurations required for the feature to function. Ensure you include all the employees you want to protect, even if they don't have a Dashlane seat.

   Even though these are configured as Intune device configurations, the assignments need to be to Groups, not Devices.

   

   Although Credential Protection features are most beneficial when rolled out to your entire organization, you can start with a smaller group (or just yourself) by restricting the policy. You can extend Credential Protection to more of your employees at any time.

6. Select the Select button and then select Next.

7. Review and validate the configuration, then select Add. A message confirms the policy was created.

   

After performing these steps, the deployment might take up to eight hours, but it's usually faster.

To ensure Risk Detection's proactive threat monitoring doesn't alert or disrupt employees, you must wait for the policy to take effect in your MDM.

Check that the policy was applied:

Using a device that was part of the group the script was deployed to, go to Registry Editor and select the following folders in order.

Chrome:

HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\3rdparty\extensions\fdjamakpfbbddfjaooikfcpapjohcfmg\policy

Edge:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\3rdparty\extensions\gehmmocbbkpblljhkekmfhjpfbkclbph\policy

In the extensions, you'll see a folder named using the Dashlane browser extension ID. Under that folder, the policy folder contains the actual values of the Credential Protection policy.

Once you have verified the policy is active on target machines, the browsers will silently fetch and install the Dashlane extension in the background without any visible prompts or actions required from your employees.

You can then go back to the Dashlane Admin Console, go to Configurations and Policy Deployment with Extension, and select Mark as done to confirm the policy setup.

Under Available security tools, toggle on the features you want to activate:

• Risk Detection
• Credential Risk Alerts
• AI Phishing Alerts

All threat logs, intercepted phishing attempts, and risk indicators will begin populating in your Admin Console’s Activity Log, Risk Detection, and Phishing Alerts dashboards.

If the extension didn't install

• Confirm the Dashlane desktop extension was deployed. The script exits silently if it can't detect a signed-in user, which usually means Credential Risk Detection wasn't present.
• Check the platform script's run status in Intune, under Device status and User status, for that policy.

Watch the Windows + Intune setup video

You can watch a step-by-step video of the Windows + Intune setup.

Remove Credential Protection

To remove Credential Protection and the browser extension from a device, use the companion uninstall script rather than deleting the platform script assignment. Deleting the assignment alone doesn't undo the registry changes or remove cached extension data.

1. Copy this script into a local PowerShell file.

   Removal script

   
   #Requires -RunAsAdministrator
   
   Set-StrictMode -Version Latest
   $ErrorActionPreference = "Stop"
   
   $ChromeExtensionId = "fdjamakpfbbddfjaooikfcpapjohcfmg"
   $EdgeExtensionId   = "gehmmocbbkpblljhkekmfhjpfbkclbph"
   
   $ChromeExtensionValue = "$ChromeExtensionId;https://clients2.google.com/service/update2/crx"
   $EdgeExtensionValue   = "$EdgeExtensionId;https://edge.microsoft.com/extensionwebstorebase/v1/crx"
   
   $ChromePolicyPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\$ChromeExtensionId"
   $EdgePolicyPath   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\$EdgeExtensionId"
   
   $ChromeForceListPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
   $EdgeForceListPath   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"
   
   $ChromeBlockListPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist"
   $EdgeBlockListPath   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist"
   
   function Ensure-RegistryKey {
       param([Parameter(Mandatory = $true)][string]$Path)
   
       if (-not (Test-Path $Path)) {
           New-Item -Path $Path -Force | Out-Null
       }
   }
   
   function Remove-RegistryKeyIfExists {
       param([Parameter(Mandatory = $true)][string]$Path)
   
       if (Test-Path $Path) {
           Remove-Item -Path $Path -Recurse -Force -ErrorAction Stop
       }
   }
   
   function Get-ExistingRegistryListEntries {
       param([Parameter(Mandatory = $true)][string]$Path)
   
       $results = @()
   
       if (-not (Test-Path $Path)) {
           return @($results)
       }
   
       $props = Get-ItemProperty -Path $Path -ErrorAction Stop
   
       foreach ($prop in $props.PSObject.Properties) {
           if ($prop.Name -match '^\d+$') {
               $results += [PSCustomObject]@{
                   Name  = $prop.Name
                   Value = [string]$prop.Value
               }
           }
       }
   
       return @($results)
   }
   
   function Remove-RegistryListEntry {
       param(
           [Parameter(Mandatory = $true)][string]$ListPath,
           [Parameter(Mandatory = $true)][string]$ValueToRemove
       )
   
       if (-not (Test-Path $ListPath)) {
           return
       }
   
       $entries = @(Get-ExistingRegistryListEntries -Path $ListPath)
   
       foreach ($entry in $entries) {
           if ($entry.Value -eq $ValueToRemove) {
               Remove-ItemProperty -Path $ListPath -Name $entry.Name -Force -ErrorAction Stop
           }
       }
   }
   
   function Add-RegistryListEntry {
       param(
           [Parameter(Mandatory = $true)][string]$ListPath,
           [Parameter(Mandatory = $true)][string]$ValueToAdd
       )
   
       Ensure-RegistryKey -Path $ListPath
   
       $entries = @(Get-ExistingRegistryListEntries -Path $ListPath)
   
       foreach ($entry in $entries) {
           if ($entry.Value -eq $ValueToAdd) {
               return
           }
       }
   
       $nextIndex = 1
   
       if ($entries.Count -gt 0) {
           $nextIndex = (($entries | ForEach-Object { [int]$_.Name } | Measure-Object -Maximum).Maximum) + 1
       }
   
       New-ItemProperty -Path $ListPath -Name ([string]$nextIndex) -Value $ValueToAdd -PropertyType String -Force | Out-Null
   }
   
   function Remove-ExtensionFolders {
       param(
           [Parameter(Mandatory = $true)][string]$RelativeUserDataPath,
           [Parameter(Mandatory = $true)][string]$ExtensionId
       )
   
       $userRoots = Get-ChildItem "C:\Users" -Directory -ErrorAction SilentlyContinue |
           Where-Object {
               $_.Name -notin @("Public", "Default", "Default User", "All Users")
           }
   
       foreach ($userRoot in $userRoots) {
           $browserUserDataPath = Join-Path $userRoot.FullName $RelativeUserDataPath
   
           if (-not (Test-Path $browserUserDataPath)) {
               continue
           }
   
           $extensionFolders = Get-ChildItem -Path $browserUserDataPath -Directory -Recurse -ErrorAction SilentlyContinue |
               Where-Object { $_.Name -eq $ExtensionId }
   
           foreach ($folder in $extensionFolders) {
               Remove-Item -Path $folder.FullName -Recurse -Force -ErrorAction SilentlyContinue
           }
       }
   }
   
   try {
       Remove-RegistryListEntry -ListPath $ChromeForceListPath -ValueToRemove $ChromeExtensionValue
       Remove-RegistryListEntry -ListPath $EdgeForceListPath -ValueToRemove $EdgeExtensionValue
   
       Remove-RegistryKeyIfExists -Path $ChromePolicyPath
       Remove-RegistryKeyIfExists -Path $EdgePolicyPath
   
       Add-RegistryListEntry -ListPath $ChromeBlockListPath -ValueToAdd $ChromeExtensionId
       Add-RegistryListEntry -ListPath $EdgeBlockListPath -ValueToAdd $EdgeExtensionId
   
       Remove-ExtensionFolders `
           -RelativeUserDataPath "AppData\Local\Google\Chrome\User Data" `
           -ExtensionId $ChromeExtensionId
   
       Remove-ExtensionFolders `
           -RelativeUserDataPath "AppData\Local\Microsoft\Edge\User Data" `
           -ExtensionId $EdgeExtensionId
   
       exit 0
   }
   catch {
       exit 1
   }
   
             

2. Deploy it as a new Intune platform script, following the same steps above, targeting the devices or groups you want to roll back.

The uninstall script removes the force-install entries for Chrome and Edge, deletes the Credential Protection policy registry keys, adds the Dashlane extension ID to each browser's block list, so it can't be silently reinstalled, and clears cached extension folders for each user profile on the device.