Google Chrome and data security

[sraper]

Good Morning

 

Really not sure where to post this one none of the existing forums seemed appropriate.

 

Have two issues with Google Chrome on Windows 10 (and I presume Windows 11 but not tested). The first one has been ongoing for possibly years but did not think much of it - other than an minor annoyance but I think now maybe related to the second issue which has just been spotted.

 

So we run a "typical" setup for a primary school so Windows server with AD, GP, DHCP, DNS etc all on the one physical server. All PCs on the domain ....

 

1st issue

Person A signs onto any windows 10 client and then goes and starts Google chrome.

They get busy distracted and walk away from the computer for the rest of the day!

Computer locks after a suitable time period

 

Person B comes along and sees a "spare/unused" PC and decides to use it.

Person B signs in and tries to open Google Chrome - it "NEVER" opens. No matter what they do it wont open.

So reboot PC and signs in Chrome opens fine

 

It seems that person A still being signed in and with chrome "open" is blocking a second user from using chrome

 

this has been happening for years but never thought much of it

 

2nd - more serious issue

On a teachers classroom PC - been signing into same PC for months. One day they sign off at the end of the day

Next day they call in sick and are off for 3 days.

In those 3 days two other staff cover the lessons and sign in using their credentials. They use Chrome and sign into various websites.

From the logs I can see that they both signed out correctly when they finished

On 4th day Person A comes back and signs in. When they use Chrome they can see the other users Autofill data etc:mad:

[PrimaryNetMan]

It would appear that the Chrome data is redirected / and or shared across user profiles.

 

Experienced similar issue back in the day with redirected appdata. If a user signed on to another PC they wouldn't be able to open Chrome as the profile was locked on another machine. What you have said appears to the same behaviour, with the addition of it happening across different users.

[DGardiner]

Good Morning

 

Really not sure where to post this one none of the existing forums seemed appropriate.

 

Have two issues with Google Chrome on Windows 10 (and I presume Windows 11 but not tested). The first one has been ongoing for possibly years but did not think much of it - other than an minor annoyance but I think now maybe related to the second issue which has just been spotted.

 

So we run a "typical" setup for a primary school so Windows server with AD, GP, DHCP, DNS etc all on the one physical server. All PCs on the domain ....

 

1st issue

Person A signs onto any windows 10 client and then goes and starts Google chrome.

They get busy distracted and walk away from the computer for the rest of the day!

Computer locks after a suitable time period

 

Person B comes along and sees a "spare/unused" PC and decides to use it.

Person B signs in and tries to open Google Chrome - it "NEVER" opens. No matter what they do it wont open.

So reboot PC and signs in Chrome opens fine

 

It seems that person A still being signed in and with chrome "open" is blocking a second user from using chrome

 

this has been happening for years but never thought much of it

 

2nd - more serious issue

On a teachers classroom PC - been signing into same PC for months. One day they sign off at the end of the day

Next day they call in sick and are off for 3 days.

In those 3 days two other staff cover the lessons and sign in using their credentials. They use Chrome and sign into various websites.

From the logs I can see that they both signed out correctly when they finished

On 4th day Person A comes back and signs in. When they use Chrome they can see the other users Autofill data etc:mad:

 

How are you redirecting profile/browser data - im assuming you have this done weirdly and the file is "locked" so the second client cant open

[PotNoodleTech]

OK

 

1st issue is a weird one - we don't have that issue here and teachers use the switch user function in w10 all the time - chrome opens for each user that switches user.

 

2nd issue is simple - because the other members of staff signed in with the "teacher who was off's" user account - anything they did on that teachers user account will be there for that teacher to see when they returned from ilness and singed in, browser history, usernames and passwords. Put simply the cover staff should not have been given the "teacher who was ill's" username and password as whilst sharing user accounts used to be the norm 10 to 20 years ago that is a big no no nowadays.

 

Theres no security issue or anything to worry about with issue 2 - just very bad user/security habits which you need to change, politely.

 

Issue 1 seems to be some kind of bug or as people have said above could be something set up wrong with the user profiles in group policy

Edited November 15, 2024 by PotNoodleTech

[sraper]

It would appear so - but I have checked through all the chrome settings in GPO and the closest relevant one is "Set the roaming profile directory"

 

They can happily sign onto multiple computers to use Chrome - but only ONE user per PC

[sraper]

OK

2nd issue is simple - because the other members of staff signed in with the "teacher who was off's" user account - anything they did on that teachers user account will be there for that teacher to see when they returned from ilness and singed in, browser history, usernames and passwords. Put simply the cover staff should not have been given the "teacher who was ill's" username and password as whilst sharing user accounts used to be the norm 10 to 20 years ago that is a big no no nowadays.

That was my assumption but I have checked that machine carefully and we have scripts that run at logon and logoff to write these events into a custom log file,

 

Person A in question definately logged off and did not log back in untill 3 days later. The only login/logoff events during these 3 days were for two other users!

[PotNoodleTech]

It would appear so - but I have checked through all the chrome settings in GPO and the closest relevant one is "Set the roaming profile directory"

[ATTACH=CONFIG]72634[/ATTACH]

 

They can happily sign onto multiple computers to use Chrome - but only ONE user per PC

 

It might not be a google chrome setting it could be a setting to do with the profiles on the PC? Do you have local profiles or do you redirect user profiles to a certain location?

[sraper]

Profiles are redirected to a share on the server

 

In the chrome GPO for "set the roaming profile directory" it is set to ${documents}\Chrome so that redirects their Chrome "profile" in to a folder called Chrome in "My Documents" eg \\server\StaffData$\Teacher\username\Documents\Chrome which is what makes this even more confusing as nothing chrome releated should be on the local PC - let alone shared amongst all users!!!

 

I think we may also have UE-v settings as well - could they be overriding the above and causing the issue???

[sraper]

On the PC that had the main issues I have just noticed that there is a c:\Chrome\Default\profile.pb" ! However that is owned by "Administrators" and nothing I can see should allow Chrome to create or modify that!

[Accura2k7]

Assuming you are using Chrome Enterprise and not the standard end user edition?

[FN-GM]

Looks like the redirect data is on the local PC. Why do you have that anyway? Maybe just kill that setting?

[Driftingashore]

The .pb file definitely seems wrong to be in a path like c:\Chrome\Default\profile.pb .. it should be saved to the path set in your roaming profile directory GPO setting (assuming it was modified recently and isn't some leftover from a test). Worth looking in http://chrome://policy to see what policies are actually being applied.. maybe you have a rogue GPO?

[sraper]

The .pb file definitely seems wrong to be in a path like c:\Chrome\Default\profile.pb .. it should be saved to the path set in your roaming profile directory GPO setting (assuming it was modified recently and isn't some leftover from a test). Worth looking in http://chrome://policy to see what policies are actually being applied.. maybe you have a rogue GPO?

 

If you mean this "In the chrome GPO for "set the roaming profile directory" it is set to ${documents}\Chrome"

 

then that ${documents} maps to the user's "my documents" which in this case is redirected to a folder on the sever. this is working "correctly" in that within their "my documents" there is a Chrome folder which is uptodate and has various settings/config files and folders in it. The point is that that is working correctly IMO and very user has their own copy in their own my documents on the server.

 

and yet something somewhere is being "shared" locally on the C drive amongst all users - so it would seem