I am deploying Chrome through group policy. This is working fine.

Obviously Chrome has a pretty regular update cycle. I am not allowing Domain Users to install Chrome updates.

Having subscribed to the release blog, and downloaded/tested a new release MSI, what is the "correct" way to deploy a Chrome MSI?

For example: do I use the built in Group Policy MSI update feature? Do I overwrite the MSI file with a new one? Do I delete the policy and make a new one, linked to the newer MSI? Or do I allow Domain Users to perform Chrome updates automatically?

P.S. As a humorous aside, if this question gets down-voted, closed or voted to be closed as non-constructive, I will probably kill myself. You will have blood on your hands.

  • 1
    +1 for the postscript – Ryan Ries Mar 21 '13 at 14:07
  • 3
    Haha, thanks. I get very frustrated at the amount of legitimate questions (some of my own), across the Stack Exchange community get over-moderated. Since I first started using SO a few years ago, things have really gone downhill, imo of course. – George Mar 21 '13 at 14:09
  • 1
    pretty regular update cycle hmm. quite. The reason we don't use it here. – tombull89 Mar 21 '13 at 14:18
  • 1
    @tombull89 Unlike, say, Flash, Reader, Java or Windows? :) – jscott Mar 21 '13 at 14:32
  • 1
    @George The Google Update Service will update Chrome and its bundled version Flash Player. It will not affect the ActiveX/Plugin(Mozilla) versions of Flash Player. – jscott Mar 21 '13 at 14:48

You ultimately need to check whether Chrome can be updated or not - suggest making a policy in a test OU with a machine in it.

If it can be updated, you could add a new MSI to the same GPO each time, and let it roll it out.

By unticking the 'Uninstall this application when it falls out of the scope of management' option, you can remove old MSIs from the GPO without it trying to perform an uninstall at the clients, when they next update their policies.

I know I've not been completely specific with this program, but I hope this helps anyway. With feedback, the answer can probably be made more specific to Chrome, but their enterprise MSI is not special as such, it is just an MSI!


Just to sum up the answer to this question (based on the further discussion in the comments below).

  • Create a GPO for handling Chrome (solely is a good idea for organisation)
  • Each time a Chrome update is released, add the MSI as a new assigned entry in the Software Installation section of the GPO.
  • Be sure to disable the "Uninstall software when it goes out of scope" option
  • Since a GPO is applied in an old->new order, you can safely delete the software assignments for old Chrome versions, just keeping the latest version and one or two prior to this.

Credit to Snellgrove.

  • Thank you for posting, this is helpful. I have noticed that by adding a new MSI, Chrome does seem to update itself. My concern is however that within a few months, I would end up with a load of redundant old MSIs. Your 3rd paragraph is particularly helpful - knowing this I know I can now just overwrite the MSI with a new version, provided that tick box is unchecked. Thank you. – George Apr 3 '13 at 12:48
  • 3
    Well, to clarify further, it's not that you overwrite it, you just add the next MSI to the same GPO. So when a new PC joins the domain and is affected by this policy, it'll go through the policy, installing the MSI files, in order. There's a priority to the MSI's (oldest first, basically). The thing you'll probably want to do, is just remove the old MSI files so only the previous (in case of rollback being required) and latest, is left within the GPO. HTH! – Snellgrove Apr 3 '13 at 12:53
  • Ooh right, well this is what I've been doing. So can I just clarify: One GPO; multiple MSI assignments (each version); delete the oldest MSI files, leaving only the latest two? – George Apr 3 '13 at 15:26
  • That's it, procedure wise. It's of course up to you if you leave a previous version or not, or maybe more! it's just for making things easier if you need to roll back a version. Alternatively, keep all your MSI's in a folder somewhere (I'm assuming you've got a binaries & downloads dump like most people!) ready to attach to a GPO. – Snellgrove Apr 3 '13 at 16:54
  • Thanks, that's great. I have accepted and edited your answer to include a summary of the discussion here. It's pending peer review but I'm sure it will be a good move in the interest of completion. Thanks for all of your time. – George Apr 3 '13 at 17:05

I know that if you use a third-party GP management suite (like PolicyPak) you can push out MSI's as updates/upgrades to existing installs easily. It runs the MSI as an update, rather than as a full install. It's how the place I worked at last spring/summer managed updates and such.

  • 1
    Would like to avoid 3rd party solutions if possible, but thanks for your suggestion :) – George Apr 3 '13 at 15:21
  • 1
    That's fair enough. – acolyte Apr 3 '13 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.