Sunday, January 29, 2012

How to Stop Users From Installing Google Chrome

Here's how you can create the Block Google Chrome software restriction policy for your Vista or XP machines:
  1. Open the Group Policy Management Console (GPMC).
  2. Right-click your domain and choose the Create a GPO in this domain, and link it here option.
  3. Name the Group Policy Object (GPO) Block Google Chrome and click OK.
  4. Right-click the policy you just created and click Edit.
  5. Navigate to the User Configuration\Policies\Windows Settings\Security Settings\Software Restriction Policies folder.
  6. Right-click Software Restriction Policies and select New Software Restriction Policies.
  7. Right click Additional Rules and choose New Path Rule.
  8. In the Path field, type chromesetup.exe.
  9. In the Security level drop-down box, choose Disallowed and click OK.
  10. Repeat steps 7 through 9 for the chrome.exe and gears-chrome-opt.msi files.
  11. Repeat steps 7 through 9 for the path C:\Users\%username%\AppData\Local\Google\Chrome\Application\chrome.exe for Vista machines or C:\Documents and Settings\%username%\Local Settings\Application Data\Google\Chrome\Application\chrome.exe for XP machines. You should include this rule in case some of your users have already installed the browser. After you implement the GPO and the Group Policy settings refresh on those users' local machines, they'll no longer be able to successfully run Google Chrome.
  12. Open a command-prompt window and run the command
    gpupdate /force
    to apply the new rules.
  13. Run the command
    gpresult /R
    in Vista SP1 or the command
    in XP and Vista (pre-SP1) to verify that the newly created GPO has successfully been applied.
  14. As a final test, attempt to run the installer from the Google Chrome website. If the policy is successful, you should see the error that Figure1 shows.

With the Block Google Chrome software restriction policy, you can stop users from installing and using Google's new web browser without IT's consent. (Note that if you want some users to be able to install and run the browser, you can filter the GPO so that it won't affect them.) You can even adapt these steps to block other applications that install to user-accessible areas in the OS and registry.


No comments:

Post a Comment