how can prevent Chrome Extensions from being installed without an administrator password?

Start here.

https://support.google.com/chrome/a/answer/187202?hl=en

Download the ADMX files for Chrome. It will allow you manage your global chrome settings via GPO.

Here's a page with what you can control with extensions.

https://support.google.com/chrome/a/answer/7532015?hl=en

yes we have followed both of these already, however as the question states, we want administrators to be able to install extensions. but not regular users.  the links you sent are all or nothing.

Then deny write permissions on C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions  folder for all users and allow administrators.

thanks Shaun, yes we have tried that but how can we then allow administrators to install extensions?

Administrators would have permissions to write to that folder.

Users would not be able to write their thus their install would fail.

but then how would we have the ability to add chrome extensions for a user.  

the idea is that only admin could add for a user, not the user themselves.

with your solution above, this would only work on the "administrator" profile on the system, not for the regular users profile with admin pwd.

This is a fix on a very basic level.

When a user tries to install and extension to Chrome it was fail because the user will not be able to write data to the folder where chrome install extensions.

There doesn't seem to be a way to have chrome prompt for a username/password when attempting to install an extension.

You'd probably have to run chrome as an administrator, then install the extension, while logged into the user's account for it too be installed correctly in your scenario.

yes we have tested and when running as "administrator" it installs into the admin profile not the user profile logged in

but then how would we have the ability to add chrome extensions for a user.  

Try to install it in Admin user then copy extension to user's extension folder

You could probably get really fancy and make a script that:

1. Closes chrome
2. Prompt for Admin
3. Changes write permissions to the specified path
4. (here is where you have the user install the extension)
5. Changes the permissions back

But would it really be worth it?

shaun could that potentially replace "all" of the existing extensions for the user?

thanks guys. looks like we cant really do what we hoped but appreciate the feedback and suggestions.