My client (XP) can install Chrome in his system being a domain user account. how can i stop him/them from installation of Chrome through Windows Server 2003.

  • Is the user granted local administrator rights?
    – jscott
    Feb 12 '13 at 10:52
  • Chrome installs into the users account so generally Admin rights don't come into it.
    – dunxd
    Feb 12 '13 at 11:18
  • 1
    @dunxd I ask because there is a Group Policy to block per-user installs specifically. This policy would not block administrators from performing per-computer installs.
    – jscott
    Feb 12 '13 at 11:49

If the users do not have local administrator access, you may simply disable per-user installations via Group Policy.

DisableUserInstalls is a machine policy which will block per-user installations. There is also an option for "hiding" existing per-user installed applications in favor of the per-computer installed versions.

To configure:

  1. Open gpmc.msc, select the GPO to which you will add the policy.
  2. Navigate Computer Configuration, Policies, Administrative Templates, Windows Components, Windows Installer.
  3. Set the policy "Prohibit User Install" to "Enabled".
  4. [Optional] Set the policy "User Install Behavior" to "Hide User Installs".
  • 1. may be gpedit.msc . It works for me not gpmc.msc. Apr 29 '15 at 16:31
  • 1
    @KabirHossain gpedit will modify the local policy. gpmc is the domain policy editor. You may need to install RSAT.
    – jscott
    Apr 29 '15 at 16:41
  • I've since learned that gpmc.msc doesn't come loaded on Windows Server by default, and must be installed as follows: 1. Open Server Manager and click Add Roles and Features. 2. In the Add Roles and Features Wizard dialog that opens, click Features on the left pane, and then select Group Policy Management. 3. Click Next to proceed to the confirmation page. 4. Click Install to enable it. This allowed me to run gpmc.msc and perform the steps in this answer. Mar 30 '19 at 17:53
  1. Open the Group Policy Management Console (GPMC).
  2. Right-click your domain and choose the Create a GPO in this domain, and link it here option.
  3. Name the Group Policy Object (GPO) Block Google Chrome and click OK.
  4. Right-click the policy you just created and click Edit.
  5. Navigate to the User Configuration\Policies\Windows Settings\Security Settings\Software Restriction Policies folder.
  6. Right-click Software Restriction Policies and select New Software Restriction Policies.
  7. Right click Additional Rules and choose New Path Rule.
  8. In the Path field, type chromesetup.exe.
  9. In the Security level drop-down box, choose Disallowed and click OK.
  10. Repeat steps 7 through 9 for the chrome.exe and gears-chrome-opt.msi files.
  11. Repeat steps 7 through 9 for the path C:\Users\%username%\AppData\Local\Google\Chrome\Application\chrome.exe for Vista machines or C:\Documents and Settings\%username%\Local Settings\Application Data\Google\Chrome\Application\chrome.exe for XP machines. You should include this rule in case some of your users have already installed the browser. After you implement the GPO and the Group Policy settings refresh on those users' local machines, they'll no longer be able to successfully run Google Chrome.
  12. Open a command-prompt window and run the command to apply the new rules.

    gpupdate /force

  13. Run the command

    gpresult /R

  14. Verify that the newly created GPO has successfully been applied. As a final test, attempt to run the installer from the Google Chrome website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.