Google Chrome Configuration recipe (macOS)

Description

After installing Chrome, some configuration may be desirable, examples may include:

• Block auto updates
• Set home page
• Disable Welcome Page

The below shows configuration for macOS.  For Windows you may wish to consider GPO: Manage Chrome updates (Windows)

Ingredients

• FW Central
• Chrome installer application already as a Fileset
• The provided configuration Fileset:

macOS

Directions

Install Chrome before running the helper: it reads /Applications/Google Chrome.app/Contents/Info.plist. For managed profile delivery on macOS 11 and later, the Mac must also be enrolled in MDM; see Apple Profile Filesets. Test the imported Fileset requirements and these settings on a pilot Mac before broader assignment.

1. Download the Fileset zip file, expand and drag both the Fileset and Configuration Profile into FileWave > Filesets
2. The 'Google Chrome Ksadmin' Fileset contains a legacy 'ksadmin.sh' helper. It looks for ksinstall and Keystone.tbz inside the installed Chrome app, then attempts to install and register the Keystone updater. Confirm those components exist before using this helper; it does not provide a fallback if they are missing.
3. Review the entire example Configuration Profile before deployment, not just the Welcome and Home Page values. Its Chrome settings include SyncDisabled=true, DefaultNotificationsSetting=2, disabled import preferences, and home/startup URLs set to www.filewave.com. Keep only the settings your organization intends to manage.

Preference Names
A list of policies can be found at: Chrome Enterprise policy list

Association

When associating, to ensure the configuration is installed with the Application, consider creating a Fileset Group:

Associating the 'Google Chrome Managed' Fileset Group will ensure Application and Configuration are associated to devices.  

When there is an update to Google Chrome, test the new version and replace the version in the Fileset Group. Reinstall Google Chrome Ksadmin only if the installed Chrome still contains the Keystone components required by that helper. Grouping the Filesets assigns them together; confirm Chrome is installed before the helper runs.

The helper ends with exit 0 even if an earlier updater command fails. Do not treat a successful Fileset status alone as proof that Chrome update controls took effect. Check the helper output, the installed Chrome version, and the intended browser settings and update behavior on the pilot Mac before expanding the assignment.

Controlling Updates

Updates may be managed with the use of additional configuration that may be added to the Fileset Group.

The downloadable Chrome Preferences Keystone profile sets UpdateDefault to 3 for com.google.Chrome, as shown below. This disables both scheduled and manual Chrome browser updates through Google Software Update. Google recommends keeping updates enabled so security fixes arrive. If you deliberately disable them, provide a timely alternative update process and a plan to re-enable them. This browser-update setting does not disable every Chrome component update.

<key>updatePolicies</key>
<dict>
  <key>com.google.Chrome</key>
  <dict>
    <key>UpdateDefault</key>
    <integer>3</integer>
  </dict>
</dict>

Download: Chrome Preferences Keystone.mobileconfig

Edit the profile integer to match the desired experience:

Add the 'mobileconfig' file as a Custom Settings Configuration Profile Payload

Google Software Management
Other Google software may also be managed with this process. Please read Manage Chrome updates (Mac) for full details of management options.