Block Chrome Installing
Hello,
Is there a way i can block users from opening/launching Chrome on a machine with KACE? I work at a hospital and due to some of our applications our end users are admins. They tend to install Chrome and i'd like to either Block this with KACE or stop it from opening.
I'm not on KACE 6.0 yet. We should be there in the next month.
Thanks
Brian
1 Comment
[ + ] Show comment
-
Looking ahead to v6.0 there is the ability within Kace to blacklist applications. Haven't personally used it to give you any direct feedback - but it's there. - jegolf 9 years ago
Answers (4)
Please log in to answer
Posted by:
anonymous_9363
9 years ago
The GPO route is a good one, as it allows flexibility with AD group scoping.
Whichever route you choose, once you've sorted it, you need to investigate whether the apps really need admin rights - I've only ever come across one which explicitly checked for admin status (and a subsequent release fixed that). Normally, the app just needs write access to the file system and/or the registry. A few minutes with ProcMon will show you what access permissions an app requires.
Whichever route you choose, once you've sorted it, you need to investigate whether the apps really need admin rights - I've only ever come across one which explicitly checked for admin status (and a subsequent release fixed that). Normally, the app just needs write access to the file system and/or the registry. A few minutes with ProcMon will show you what access permissions an app requires.
Posted by:
EdT
9 years ago
If I recall correctly, Chrome will install in ProgramData for non admin users so being an admin is not necessary to install Chrome. Therefore an enterprise solution such as group policy is realistically the most reliable way to proceed.
Posted by:
rockhead44
9 years ago
Are you an Active Directory shop? If so, the game restriction GPO will work. It will prevent chrome.exe from launching
As for the k1000, I've never done this for Chrome but it works for other apps. Go to Scripting - Security Policies - Disallowed Windows Programs and type in chrome.exe and check the box to disallow programs
That will create a script for you from which you can set schedule and login parameters. It's only going to block on a certain schedule so someone may have a more elegant solution.
Another option is a script that targets your machines that have Chrome installed and uninstalls Chrome on them. That won't stop someone from reinstalling prior to your next scheduled script execution.
I will follow this and look forward to others' responses.
Posted by:
vjaneczko
9 years ago
You can also do some research on Microsoft AppLocker : https://technet.microsoft.com/en-us/windows/applocker.aspx
