Chrome Updates UAC

[mdench]

We have chrome installed across the site as the default browser. Staff are being asked to enter a user / password for UAC to allow chrome to make changes to the PC. Only a domain admin login works for this but staff are super users on the pcs to allow sims updates etc and have full permissions to C:\ProgramFiles\Google

 

Can anybody point me in the right direction? So we can have chrome just update silently?

[free780]

Get the enterprise msi turn off updates via gpo. Deploy the new version via gpo.

[mdench]

we would quite like to auto update so we dont have to keep downloading the latest version and update it through gpo

[Arthur]

Get the enterprise MSI turn off updates via GPO. Deploy the new version via GPO.

Google strongly recommends you don't do that. Apart from the obvious security risks, you will also run into Chrome profile issues if users log multiple PCs and each has a different version of the browser.

[free780]

If you read the bottom bullet point of the article it actually say do test and deploy dont just auto update.

[Arthur]

So we can have chrome just update silently?

Are you currently using the Google Update ADM file to control how Chrome updates are installed in Group Policy?

 

support.google.com/installer/bin/answer.py?hl=en&answer=146164

 

http://i.imgur.com/B7a8fje.png

 

 

The Updater runs using the local SYSTEM account so users should never see the UAC box.

 

http://i.imgur.com/RyvzF3s.png

 

One thing you could try is to remove the "At log on of any user" trigger for the GoogleUpdateTaskMachineCore scheduled task to see if that makes any difference?

 

http://i.imgur.com/HBFEonv.png

 

If you read the bottom bullet point of the article it actually say do test and deploy don't just auto update.

http://i.imgur.com/u2XOjpR.png

 

http://i.imgur.com/jnWwoNc.png

 

http://i.imgur.com/7eGKO9C.png

[free780]

• I need auto-updates turned off so I can test new versions of Google Chrome before everyone else gets them. What do you suggest I do?
  
  • Turn off auto-updates as described above, and push the group policy to your network.
    
  • Watch for updates on the Google Chrome release blog.
    
  • Whenever you see a new version that you want to release, download and deploy the latest version on your test machines. See the previous question for instruction links.
    
  • Do your verification tests.
    
  • Once Google Chrome is certified, deploy the new Chrome to the rest of your network.
    

 

Surely if the updater runs as the system account. The system account would need internet access. I'm guessing you don't allow direct access to your firewall. You probably have a proxy server. If you had SCCM you have just superseed the previous version.