Restore browser settings after a hijacker changes group policies

A browser hijacker can change your homepage, search provider, new-tab page and extension permissions, then use Windows group policies to prevent you from reversing those changes. The browser may display “Managed by your organisation” even when the computer belongs to you.

This problem affects Chrome, Edge and Firefox users across Australia, including people on home NBN connections and small-business computers in Sydney, Melbourne or Brisbane. Before changing policies, determine whether the device is genuinely managed by an employer, school or government organisation.

Recognise a policy lock

Typical symptoms include a search engine that returns to an unfamiliar site, an extension that cannot be removed, or settings that revert after every restart. Chrome and Edge may show a policy warning on their settings pages, while Firefox can report that an administrator controls particular options.

A hijacker often arrives with freeware, fake updates, cracked software or a bundled installer. Some threats behave like worms and spread through removable drives or poorly protected network shares, so review worm removal guidance if several computers show similar symptoms.

Write down the unwanted homepage, search provider, extension names and policy messages before making changes. These details can help distinguish a browser configuration problem from a wider malware infection.

Secure the device first

Disconnect the computer from the internet temporarily if the browser is opening suspicious pages or downloading files. On an Australian home network, switching off Wi-Fi is usually enough; unplugging the Ethernet cable from the NBN router or computer is another option. Avoid signing into online banking, myGov or email until the device has been checked.

Run a full scan with Windows Security, then use a reputable second-opinion scanner if the problem remains. Quarantine detected items rather than deleting random registry entries immediately. A threat may recreate browser policies if its scheduled task, service or startup entry is still active.

If the webcam activates unexpectedly or an unknown process requests camera access, investigate that separately. The camera access cleanup guide can help identify a related privacy threat.

Check legitimate management

A “managed by your organisation” message is not automatically evidence of infection. Many Australian workplaces use Microsoft Intune, domain policies or security software to enforce approved browsers, extensions and proxy settings. A school-issued laptop may also have restrictions that return after each sign-in.

Ask the employer or school IT team before removing anything if the computer uses a work account, corporate VPN or organisation-owned antivirus. On a personal Windows PC, open Settings and review Accounts, Access work or school. Remove only an account or connection you recognise as unwanted.

Business users should record the device name and policy details before changing them. Removing a legitimate restriction can break access to internal systems, printers or secure portals, particularly in small firms that rely on centrally managed Microsoft 365 computers.

Remove malicious policies

Create a restore point and export relevant registry keys before editing them. Open Registry Editor as an administrator and inspect these locations:

• HKEY_CURRENT_USER\Software\Policies\Google\Chrome
• HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Edge
• HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge

Look for entries that force an unfamiliar homepage, search provider, extension, proxy or installation URL. Do not remove an entire policy branch blindly. Compare suspicious values with the browser’s policy page and delete only entries confirmed to be unwanted.

Firefox can use Windows registry policies or a policies.json file in its installation folder. If a policy returns after deletion, inspect Task Scheduler, startup folders and recently installed applications. Restart Windows after cleanup and scan again before reconnecting to the internet.

Reset each browser

Once the malicious policy is gone, remove unfamiliar extensions and reset the browser. In Chrome, open Settings, choose Reset settings, then select Restore settings to their original defaults. In Edge, use Settings and more, Settings, Reset settings, and the equivalent restore option.

Firefox provides Help, More troubleshooting information, followed by Refresh Firefox. This removes customisations and extensions while retaining essential personal data. Export bookmarks first if they are important, and avoid restoring a browser profile from a backup that contains the hijacker.

Clear notification permissions, site data and unwanted search engines manually after the reset. If browser sync is enabled, pause synchronisation until the account and all connected devices have been checked; otherwise, a bad extension or setting may return from the cloud.

Compare browser recovery paths

The cleanup process varies by browser, especially when a policy is enforced outside the browser itself. Use this quick reference after malware has been removed and legitimate management has been ruled out.

Browser	Policy locations to inspect	Reset option	Common issue after cleanup
Chrome	Google policy registry keys	Restore original settings	Sync restores a harmful extension
Edge	Microsoft policy registry keys	Restore settings	Work account reapplies restrictions
Firefox	Registry or policies.json	Refresh Firefox	A scheduled task recreates the file

A reset changes browser preferences, but it does not necessarily remove malware from Windows. If the homepage changes again, check scheduled tasks, services, proxy settings and recently installed software rather than repeatedly resetting the browser.

Mac users will not normally have Windows Group Policy. A similar problem may be controlled by a configuration profile, login item or unwanted browser extension, so inspect System Settings for profiles and device management entries instead.

Verify the fix and prevent recurrence

Reconnect to the internet and test the browser with a clean, familiar website. Confirm that the homepage, search engine, new-tab page and extensions remain unchanged after restarting Windows. Check the browser policy page again to ensure no unknown rule has reappeared.

Keep Windows, browsers and security software updated, and download programs from their official publishers. Be cautious with fake parcel notices, tax messages and “urgent account” pop-ups, which are common social-engineering themes during busy periods such as the Australian tax season or major online sales.

For ongoing protection, review installed applications monthly and use a standard Windows account for everyday browsing. Australian users should also be wary of unofficial streaming tools and bargain software offered through marketplace listings, where bundled adware can be disguised as a useful utility. Further adware removal advice is useful when unwanted adverts continue after the browser reset.