Most of OKY's protection lands in the browser extension, so the question every IT team asks is the right one: what stops someone uninstalling it? The honest answer has two halves. On machines you manage, a managed install stops it outright — the browser itself refuses the removal. On machines you don't, nothing can stop it, so OKY does the next best thing: it tells you the moment someone stops being covered.
Why an extension can't just refuse
No browser gives an extension an API to block its own uninstall. Chrome, Edge and Firefox all withhold one deliberately: an extension that could pin itself into a browser is exactly what a malicious one would want. Any security product claiming to prevent its own removal is either describing the enterprise policy below, or describing something that doesn't work.
Force-install (the part that prevents removal)
Every platform below does the same thing: the browser installs OKY on startup, refuses to remove it, and labels it “Installed by your administrator”. Open Organization → Deployment in your dashboard — it prints the exact configuration for each platform with OKY's extension IDs already filled in, with a copy button, so nobody has to retype anything.
| Platform | What you do |
|---|---|
| Google Workspace | Admin console → Devices → Chrome → Apps & extensions → Users & browsers. Pick the organizational unit, add OKY by extension ID, set installation policy to Force install. Applies at the next policy refresh. |
| Windows (GPO / Intune) | Add OKY to ExtensionInstallForcelist under the Chrome and Edge policy keys — as a .reg file or a Group Policy setting. |
| macOS | Push a configuration profile with the same ExtensionInstallForcelist key from Jamf, Kandji, Intune or Apple Business Manager. |
| Linux | Drop a policy JSON file into Chrome's or Chromium's managed-policies directory. |
| Firefox | policies.json with ExtensionSettings set to force_installed for OKY. |
A force-installed extension also updates itself automatically and cannot be disabled from the browser's extension page, so coverage stops depending on anyone remembering anything.
Machines you don't manage
Contractors, personal laptops, anyone outside your MDM. Force-install isn't available, so set If a member removes OKY under Policies:
| Setting | What happens |
|---|---|
| Allowed | Members may remove OKY. They show as uncovered on your overview; nothing else happens. |
| Warn (default) | The removal is recorded in your audit log, your admins are notified, and the member sees a banner asking them to reinstall. |
| Block | All of the above, and that member's OKY dashboard is withheld until an install reports back. |
Block needs Require browser extension to be on — blocking people for skipping something optional would make no sense, so turning the requirement off puts the setting back to Warn. Owners and admins are never blocked: an organization must not be able to lock itself out of the screen that turns the setting off. Neither is a member who never installed OKY in the first place — that's onboarding, not removal, and Require browser extension already nudges them.
Scanning, sign-in and preferences keep working for a blocked member throughout. Withholding protection from someone who currently has none would be backwards.
How OKY knows
Two independent signals, because either one on its own could be avoided:
- The browser tells us. Chrome and Firefox open a URL on the way out when an extension is removed. Immediate and precise — but silent if the machine was offline, or if the whole browser profile was wiped.
- The install goes quiet. Every OKY client checks in regularly. Three missed cycles — 72 hours — and it counts as gone. Slower, but it can't be suppressed by uninstalling while offline.
72 hours is chosen so a laptop shut for a long weekend never produces a false “reinstall OKY”. If the install comes back, coverage restores itself and the round trip stays visible in your audit log — someone who removes OKY every Friday shouldn't read the same as someone who never removed it.
Mobile
The Android and iOS apps are covered by Require the mobile app rather than this setting — an app removal is an ordinary MDM concern, and your device management already handles required apps on managed phones.