Chrome¶
The browser touches more untrusted content than any other program. Its settings decide whether a bad website can open pop-ups, install an extension, steal a cookie, or trick a user into a download.
What you're trying to achieve¶
The same goals apply to every browser:
- It updates itself automatically.
- Sites can't open pop-ups or redirect without permission.
- Sites can't install extensions without a warning.
- Known malware and phishing sites are blocked.
- Dangerous downloads are blocked or flagged.
- Connections are HTTPS wherever possible.
- Third-party tracking is limited.
- Only extensions with a business purpose are installed.
Chrome settings¶
Open chrome://settings.
| Page | Setting | Value |
|---|---|---|
| Privacy and security → Third-party cookies | Third-party cookies | Block third-party cookies |
| Privacy and security → Third-party cookies | Send a "Do Not Track" request | On |
| Privacy and security → Site settings → Pop-ups and redirects | Don't allow sites to send pop-ups or use redirects | |
| Privacy and security → Security | Safe Browsing | Enhanced protection |
| Privacy and security → Security | Always use secure connections | On |
| Downloads | Ask where to save each file | On (gives the user a moment to think) |
| About Chrome | Version | Current. Opening the page checks for updates. |
Extensions: chrome://extensions. Remove anything without a business purpose. Names like "Free VPN," "Coupon Finder," or anything that "can read and change all your data on all websites" are the usual suspects.
These are per-user¶
Chrome stores settings in each user's profile (%LOCALAPPDATA%\Google\Chrome\User Data\Default\Preferences). Any user can change them back. To enforce them for everyone, use policy.
Enforce with policy¶
Chrome reads policies from HKLM\SOFTWARE\Policies\Google\Chrome. A value there overrides the user's choice and greys out the setting. Chrome doesn't ship Group Policy templates with Windows, so set the registry directly:
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HttpsOnlyMode /t REG_SZ /d force_enabled /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SOFTWARE\Policies\Google\Chrome |
HttpsOnlyMode |
REG_SZ | force_enabled |
HKLM\SOFTWARE\Policies\Google\Chrome |
SafeBrowsingProtectionLevel |
REG_DWORD | 2 |
HKLM\SOFTWARE\Policies\Google\Chrome |
DefaultPopupsSetting |
REG_DWORD | 2 |
HKLM\SOFTWARE\Policies\Google\Chrome |
BlockThirdPartyCookies |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Google\Chrome |
AllowCrossOriginAuthPrompt |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Google\Chrome |
AllowDinosaurEasterEgg |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Google\Chrome |
PasswordManagerEnabled |
REG_DWORD | 0 |
| Policy | What it does |
|---|---|
HttpsOnlyMode = force_enabled |
Every connection upgraded to HTTPS; plain HTTP is blocked |
SafeBrowsingProtectionLevel = 2 |
Enhanced Safe Browsing |
DefaultPopupsSetting = 2 |
Block pop-ups |
BlockThirdPartyCookies = 1 |
Block third-party cookies |
AllowCrossOriginAuthPrompt = 0 |
A third-party site embedded in a page can't pop an authentication dialog, which is a phishing technique |
AllowDinosaurEasterEgg = 0 |
Disables the offline dinosaur game. A managed-machine policy item, not a security control. |
PasswordManagerEnabled = 0 |
Chrome won't offer to save passwords (if the organization uses a separate password manager) |
Open chrome://policy to see which policies Chrome accepted.
Verify¶
chrome://policy lists every active policy with its value and a status. chrome://settings/security should show the Safe Browsing level greyed out with a "managed by your organization" note.
Example¶
chrome://settings/content/popups shows "Sites can send pop-ups and use redirects." Extensions include "Hola Free VPN." Block pop-ups, remove the extension, then set the policies above so the next user can't undo it.
Try it¶
- Set three Chrome policies with
reg addand openchrome://policyto see them. - Install an extension, then block it with the policy and watch it disappear.
Build it¶
A chrome.bat with the policy reg add lines; chrome://policy is the verify.