Why can’t delegated admins set Chrome as default on AWS WorkSpaces, and what permissions/GPO steps are required?

"Only the actions listed here are allowed for the Admin account. The Admin account also lacks permissions for any directory-related actions outside of your specific OU, such as on the parent OU. "

Here: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_admin_account.html

Creates and applies the following Group Policy Objects (GPOs): You do not have permissions to delete, modify, or unlink these GPOs . This refers to AWS-managed GPOs that are protected from customer modification. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_what_gets_created.html

Read: https://repost.aws/questions/QUTDbxIJQaS6Cy-4IQyHwzNQ/i-cannot-modify-our-default-domain-group-policy-when-using-aws-directory-services

Possible Solution: Systems Manager is the most reliable in AWS environments and bypasses AD permission issues entirely. https://aws.amazon.com/de/blogs/mt/software-deployment-to-amazon-workspaces-using-aws-systems-manager/

1. Enable Systems Manager for WorkSpaces (as documented in the AWS blog)
2. Create a PowerShell script to set default associations:

# Create and import default associations XML
$xmlContent = @'
<?xml version="1.0" encoding="UTF-8"?>
<DefaultAssociations>
  <Association Identifier=".html" ProgId="ChromeHTML" ApplicationName="Google Chrome" />
  <Association Identifier=".htm" ProgId="ChromeHTML" ApplicationName="Google Chrome" />
  <Association Identifier="http" ProgId="ChromeHTML" ApplicationName="Google Chrome" />
  <Association Identifier="https" ProgId="ChromeHTML" ApplicationName="Google Chrome" />
</DefaultAssociations>
'@
...

3. Deploy via Systems Manager Run Command

You need to be logged into the device with a user account that has Domain Administrator rights, or rights to configure GPO. The following shows how to create users from an EC2 instance, but can also be used to configure GPOs. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_manage_users_groups_ec2.html .