If the goal is to have a standard working system that people can actually use to get their work done you want to exert at least some control. If you just want to provide your users with whatever baubels they can be tricked into installing then that is your perogative.
not had problem with updates - though it is supposed to update automatically.
It does work with impero - on workstation settings on groups - take tick out of only filter internet explorer traffic.
What you can do is hire me or my company. http://www.nutechanswers.com/
Setting the SRP to white list and allow things like %program files% and %windir% only, blocking everything else will do what you want. This will block anything in their profiles, flash drives, and temp folders. This way your not chasing a hash or wondering if the user renamed it.
We are a Google apps school so chrome is recommended. I push out the MSI and use the adm files to set the homepage and block automatic updates.
All these settings have worked well for me.
We have installed the network MSI version, for everyone to use.
Don't worry about it they can't use it to bypass any web filtering, as it uses IE proxy.
We set up a software restriction policy to prevent any executable running from C:\Users\%USERNAME%\ so even if they do manage to install Chrome, they cannot run it.
We do have the networked version already installed on our image with gpos controlling some parts of it, so I am not too sure why some of users try to download it again!
I dislike Google Chrome for this, I have been trying for a while to stop Students from installing other Browsers..
I have added all the executables like Chrome.exe to the 'Don't run specified Applications' GPO.. This works most of the time unless they rename it..
Now we have quick computers with Windows 7 and IE9 in the majority of the school, students don't bother as much to install 'quicker' browsers. Plus everything we have in school like OWA and Frog etc is designed to run on Internet Explorer so this puts them off too.
It still really annoys me when they install any software that isn't something we put on and I don't want to install alternative browsers on the computers because it conflicts with IE and causes problems (I've tried).
You guys are hardcore, who cares what browser they use? I for one love Chrome, far better and faster than IE. We have to run IE, Firefox and Chrome due to all the compatibility issues with websites these days. Some work better in IE some Chrome.. Google has a Chrome for business download and you can configure the master preferences file to make it do what you want.
We don't currently install Google Chrome as it is not compatible with all sites (such as Frog VLE). Therefore to aid the calls to our office we'd rather not install it until FrogOS comes out.
To stop the installation of Chrome Frame we use the Google Update GPO template, which I have attached: