Troubleshooting GateKeeper Browser Extension 2.3.0

Overview

GateKeeper browser extension version 2.3.0 introduced a significant change to how the browser extension communicates with the local GateKeeper Client application.

Beginning with version 2.3.0, the browser extension communicates exclusively through Native Messaging.

Previous versions of the extension supported an HTTPS communication fallback. This fallback has been removed and is no longer used.

Native Messaging support was introduced in the GateKeeper Client application beginning with the 3.16 release in early 2025. Because of this dependency, workstations must be running a GateKeeper Client version that supports Native Messaging for the browser extension to function correctly.

---

Recommended GateKeeper Client Version

Before performing any troubleshooting, verify that the workstation is running the latest GateKeeper Client version.

Current recommended version

3.18.14.0

The latest client can be downloaded from:

• Your GateKeeper Hub
• The download link provided by GateKeeper Support

---

Common Causes

If the browser extension stops communicating with the GateKeeper Client after upgrading to extension version 2.3.0, the most common causes include:

• The installed GateKeeper Client version does not support Native Messaging.
• The Native Messaging host registration is missing or incorrect.
• The browser extension was updated, but the GateKeeper Client was not.
• The Native Messaging manifest file is missing.
• Endpoint security or application control software is preventing the browser from launching the Native Messaging host.
• Browser policies are preventing the Native Messaging host from launching correctly.

---

Important Notes

Do not uninstall the GateKeeper Client application as an initial troubleshooting step.

In most cases, reinstalling only the browser extension will not resolve communication issues because the problem is related to the local GateKeeper Client installation or the Native Messaging host registration.

---

Native Messaging Registry Locations

The Native Messaging host should be registered in both the 64-bit and 32-bit registry locations when applicable.

---

Google Chrome

Registry Paths

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.untetheredlabs.nativemessaging

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Chrome\NativeMessagingHosts\com.untetheredlabs.nativemessaging

Expected Registry Value

Name	Type	Data
(Default)	REG_SZ	C:\Program Files (x86)\Untethered Labs\GateKeeper Client\chromium.json

---

Microsoft Edge

Registry Paths

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.untetheredlabs.nativemessaging

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Edge\NativeMessagingHosts\com.untetheredlabs.nativemessaging

Expected Registry Value

Name	Type	Data
(Default)	REG_SZ	C:\Program Files (x86)\Untethered Labs\GateKeeper Client\chromium.json

---

Mozilla Firefox

Registry Paths

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\NativeMessagingHosts\com.untetheredlabs.nativemessaging

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Mozilla\NativeMessagingHosts\com.untetheredlabs.nativemessaging

Expected Registry Value

Name	Type	Data
(Default)	REG_SZ	C:\Program Files (x86)\Untethered Labs\GateKeeper Client\mozilla.json

---

Browser Policy for Native Messaging Direct Launch

Some endpoint security, application control, or browser security policies may prevent Chromium-based browsers from launching the Native Messaging host.

In certain environments, Chromium browsers launch the Native Messaging host through cmd.exe. If browser child processes or command execution are blocked by endpoint security software, the browser extension may be unable to communicate with the GateKeeper Client even when all Native Messaging registry entries are configured correctly.

Chromium browsers provide a policy that instructs the browser to launch the Native Messaging host executable directly, bypassing cmd.exe.

Enabling this policy may resolve communication issues in secured environments.

---

Microsoft Edge

Registry Key

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge

Create the following value if it does not already exist:

Name	Type	Value
NativeHostsExecutablesLaunchDirectly	REG_DWORD	1

---

Google Chrome

Registry Key

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome

Create the following value if it does not already exist:

Name	Type	Value
NativeHostsExecutablesLaunchDirectly	REG_DWORD	1

---

Brave Browser

Registry Key

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\BraveSoftware\Brave

Create the following value if it does not already exist:

Name	Type	Value
NativeHostsExecutablesLaunchDirectly	REG_DWORD	1

---

When Should This Browser Policy Be Used?

Consider enabling this policy if all of the following are true:

• The GateKeeper browser extension is version 2.3.0 or later.
• The GateKeeper Client is version 3.16 or later.
• Native Messaging registry entries have been verified.
• The appropriate chromium.json or mozilla.json manifest file exists.
• Endpoint security or application control software is installed.
• Browser logs or security software indicate that browser child processes or cmd.exe execution is being blocked.

Examples of software that may enforce these restrictions include, but are not limited to:

• ThreatLocker
• CrowdStrike
• Microsoft Defender Application Control (WDAC)
• AppLocker
• Other endpoint security or application allowlisting solutions

Note: The presence of these products does not necessarily cause the issue. The problem occurs only if their security policies restrict how Chromium browsers launch Native Messaging hosts.

---

Troubleshooting Steps

Step 1 – Verify the Browser Extension Version

Open the browser's extension management page.

Confirm the GateKeeper browser extension is version 2.3.0 or later.

---

Step 2 – Verify the GateKeeper Client Version

Confirm that the workstation is running a GateKeeper Client version that supports Native Messaging.

We recommend upgrading to the latest available version.

Current recommended version:

3.18.14.0

---

Step 3 – Verify the GateKeeper Client Installation

Confirm that the GateKeeper Client is installed.

Default installation directory:

C:\Program Files (x86)\Untethered Labs\GateKeeper Client

---

Step 4 – Verify the Native Messaging Manifest

For Chrome, Edge, and other Chromium-based browsers, verify the following file exists:

C:\Program Files (x86)\Untethered Labs\GateKeeper Client\chromium.json

For Firefox:

C:\Program Files (x86)\Untethered Labs\GateKeeper Client\mozilla.json

---

Step 5 – Verify the Native Messaging Registry Entries

Verify that the appropriate Native Messaging registry keys exist for the browser being used.

Confirm that the Default registry value points to the correct manifest file.

---

Step 6 – Check Browser Policy Restrictions

If endpoint security or application control software is installed, determine whether browser child-process creation or cmd.exe execution is being blocked.

If so, configure the browser policy:

NativeHostsExecutablesLaunchDirectly = 1

for the affected Chromium-based browser.

---

Step 7 – Restart the Browser

Completely close all browser windows.

Reopen the browser and test the extension again.

---

Step 8 – Restart the GateKeeper Client

Restart the GateKeeper Client service or reboot the workstation.

Retest the browser extension.

---

If the Issue Persists

If the extension still cannot communicate with the GateKeeper Client after completing the above steps, collect the following before contacting GateKeeper Support:

• GateKeeper Client version
• Browser extension version
• Browser name and version
• Screenshot of the browser extension error
• Screenshot of the Native Messaging registry entries
• Screenshot of the NativeHostsExecutablesLaunchDirectly policy (if configured)
• GateKeeper Client logs
• Any endpoint security logs showing blocked browser or Native Messaging activity

---

Summary

Beginning with browser extension 2.3.0, GateKeeper relies exclusively on Native Messaging to communicate with the local GateKeeper Client application.

Most communication issues are resolved by verifying:

• The GateKeeper Client is version 3.16 or later (latest recommended: 3.18.14.0).
• Native Messaging registry entries are present and correctly configured.
• The appropriate Native Messaging manifest file exists.
• Endpoint security software is not blocking the Native Messaging host.
• Chromium browsers are configured to launch the Native Messaging host directly when required by the security environment..

For any additional questions or concerns regarding faster 2FA, proximity settings, computer locking, password management, or compliance, please contact GateKeeper Enterprise support using the Support Ticket form on https://gkaccess.com/support/ or email [e-mail].