Regarding "I have thought about forcing any non-admin installed extensions to be removed." We did this just recently in order to help with compatibility and data privacy. There have been a lot of rogue extensions/apps in the past, and the access to some data was questionable. Someone pointed out to me, "If you don't allow users to install programs on their computers, why do you allow them to install programs into their browser or Chromebook?". Which made a lot of sense. Now if staff try to access or install an extension, they have to request it and tell why they need it, we review their privacy policy, what they want access to and approve the ones that have merit.