users can download and install google chrome

[timbo343]

I was wondering if anyone knows why users can download and install google chrome on our machines?

For a start, why is smoothwall allowing this through?

I have found out that it is installing chrome to C:\users\{username}\appdata\google\chrome. Why would google allow this to happen?

Does anyone have a way to stop this?

[glennda]

It installs into the profile not onto the program files etc

My old hack around it was to setup in the AV software to auto delete anything called chrome.exe

[SYNACK]

I was wondering if anyone knows why users can download and install google chrome on our machines?

For a start, why is smoothwall allowing this through?

I have found out that it is installing chrome to C:\users\{username}\appdata\google\chrome. Why would google allow this to happen?

Does anyone have a way to stop this?

Google actually designed it this way to get around locked down accounts so that users could bypass the wishes of the business that they were emploied by. This I find massivly smarmy to start with. Almost worse is that because it sits in the profile and updates every 26 seconds it can end up using lots of bandwidth and expanding user profile size, users then start wineing that it is slow - their own fault etc.

There is applocker or program restrictions that you can run through GPO which can prevent programs from running from certain locations or with certain names. This could be a goo way to stop the dirty thing.

[timbo343]

Hmm i like the idea of sticking chrome in the AV and delete it... good thinking.

[CyberNerd]

Hmm i like the idea of sticking chrome in the AV and delete it... good thinking.

Why not just install it if your users want it?

[glennda]

Why not just install it if your users want it?

I agree with this - technically as it uses IE proxy they shouldn't be able to change this and it shouldn't affect them although compatibility issues could be had.

[CyberNerd]

Google actually designed it this way to get around locked down accounts so that users could bypass the wishes of the business that they were emploied by.

Allowing users to install stuff in /home/user is pretty standard practice on anything non-windows. It's not a conspiracy.

[maark]

download the msi from chrome - they also have adms you can download to control it in active directory - we give users chrome and internet explorer

[timbo343]

Why not just install it if your users want it?

Im not sure impero works with it? @russdev

We tried blocking the internet with impero as a group and they could still access the net.

I personally think they are looking at trying to get around our filtering. I have also blocked dl.google.com for users too.

[SYNACK]

I agree with this - technically as it uses IE proxy they shouldn't be able to change this and it shouldn't affect them although compatibility issues could be had.

We do for some individuals but it frankly is a pain compatibility wise, persists in its mental update cycle, tries to build in everything including the kitchen sink. Funny how to make the web browser the answer they have to copy and build in every single answer into it (PDF, Flash, new protocols). It also persists in trying to get you to sign it into google, there is a corporate version but from all accounts it is a pain to get it to push out without it choking over updates or similar.

[CyberNerd]

Im not sure impero works with it? @russdev

We tried blocking the internet with impero as a group and they could still access the net.

I personally think they are looking at trying to get around our filtering. I have also blocked dl.google.com for users too.

You should block internet access at the network level - on the firewall - client based security isn't such a good plan.

[Gatt]

Software Restriction Policy -> New Hash Policy -> Chrome.exe ?

[SYNACK]

Allowing users to install stuff in /home/user is pretty standard practice on anything non-windows. It's not a conspiracy.

But it is against the way Windows was intended to handle such things, it behaves like malware and why should Windows be Linux. For the environment it is targeted at it is skirting the rules and the mere fact they targeted it to get around the wishes of the organsations that own the computers in the first place is a tad less than ethical.

[SYNACK]

Software Restriction Policy -> New Hash Policy -> Chrome.exe ?

Rename to MyCoolNotAWebBrowser.exe and run, done. Block the whole temp folder (for limited users), it is a security risk anyway as it is where half of the malware nests.

[gshaw]

Why not just install it if your users want it?

That's fine but with the managed MSI installer, ADMs and internal update source rather than hundreds (or thousands) of machines hammering the Internet connection for auto updates. Skype used to be another culprit of this.