Skip to main content
Version: 4.42

The extension in incognito and InPrivate mode

Overview​

The Redtrust extension makes it possible to control certificate use in the browser. It reports the context of each operation (the URL) to the agent so the server can apply the relevant policies. That URL is essential to Redtrust, so it needs the extension active even during incognito browsing. By default, Chromium-based browsers (Google Chrome and Microsoft Edge) turn off extensions in private browsing mode (Incognito in Chrome, InPrivate in Edge), so you must turn it on manually.

The standard procedure​

Normally, each user turns on the Redtrust extension in incognito in their own browser. You only need to do it once per browser, though you may need to repeat it if the extension updates or the agent is reinstalled. See the steps in Configure your browser.

Some organizations may prevent users from changing that setting. In that case, the administrator can use the corporate policies described below.

Centralized management through policies​

If you manage machines through policies (Active Directory/GPO, Intune, or other tools), Chrome and Edge offer official mechanisms to manage this setting. Neither grants the incognito permission automatically (the user approves it once), but you can:

Configuring it during installation​

Other organizations prefer to configure the extension during agent installation, so users don't have to. For that, the installer includes the AUTO_SET_INCOGNITO_MODE parameter, which tries to turn on the extension in incognito automatically.

However, Chrome and Edge treat enabling an extension in private mode as the user's decision, and they actively prevent automating that process. AUTO_SET_INCOGNITO_MODE tries to apply the setting anyway, using a technique that relies on the browser's internal behavior. Because that behavior can change at any time, the result can't be guaranteed.

  • Browsers can revert the change: On many machines, Chrome and Edge detect the modification and undo it automatically.
  • It changes with every update: Chrome and Edge update very frequently, and an internal change in a new version can invalidate the configuration overnight.
  • It depends on the machine: The result varies depending on whether the machine is joined to a corporate domain or is standalone, so it works on some machines and not others.
  • Security solutions watch for it: Modern antivirus and EDR systems monitor this kind of modification, so the process can be flagged as suspicious in some environments.

That's why AUTO_SET_INCOGNITO_MODE is only an attempt: it works on some machines and not others, depending on how the browser handles the change. For most organizations, the simplest approach is to keep the standard procedure and let each user turn it on once. The continuity of this installation parameter is under review.

Was this page helpful?