Chrome Enterprise

Deployment Guide
Set up and deploy Chrome Enterprise on
Windows in your organization
 Chrome Browser Deployment Guide | August 2023 2

About this guide

This guide focuses on the two critical steps required for a
successful Chrome Browser deployment:

● Configuration - The considerations and decisions to build

an installation package to deliver to each user/machine.

● Deployment - The timing and testing requirements for

an installation package to deploy Chrome Browser.

What is Chrome Enterprise?

Chrome Enterprise lets you deploy and manage ● Preferences can be used to set the default
Chrome browser for your organization and it does value for a particular setting, while still
not have any cost associated with it. allowing the user flexibility to change the
setting. For example, you can set the user’s
● It is a set of admin tools, resources, and
default homepage to the company intranet,
installer packages which allow an IT
set the home button to display in their
administrator to deploy and manage Chrome
toolbar, or allow the bookmarks bar
Browser in an enterprise environment.
to display in the toolbar.
When deploying Chrome Enterprise, the
For information about how to deploy initial
administrator can control Chrome default settings
preferences on users’ computers, check out
and policies using the following methods:
this link for more information.
● Policies can be used to enforce and maintain
● Note: For Chrome browser 91 or later, the
settings on client computers.
file named initial_preferences replaces the
For example, you can enable auto-updates,
master_preferences file.
and set the update interval, the default
search engine, and the default browser. ● To minimize disruption, Chrome continues
to support both filenames, and any further
change will be notified in the Chrome
Enterprise release notes.
 Chrome Browser Deployment Guide | August 2023 3

Best Practices for Chrome management

Use Chrome Browser Cloud management Review and subscribe to Chrome Enterprise
and/or Group Policy Objects (GPOs) over release notes
preferences when possible. Unlike policies,
● This provides a roadmap of upcoming
preferences do not apply to previous
features, depreciation and changes in
installations of Chrome Browser and are
Chrome browser, so reading it regularly
only applied to a single profile.
will keep you up to date and informed.
● Policies also override any
● Subscribing here to the release notes
preferences settings for a feature.
will send the notes directly to your
Also note that the initial_preferences
inbox on a monthly basis.
file can be changed and not
enforced like machine level policies.

We strongly recommend enabling Chrome

Browser auto-updates (this is the default
policy setting) to ensure that users have the
latest features and security fixes.

● Using Autoupdate also removes the

need to package and deploy Chrome
regularly, removing additional
management overhead.

● For more information on managing

Chrome Updates, check out this
update strategy doc that covers all of
the options.

Test your Chrome dependent applications

with the Beta version of Chrome.

● Chrome updates ~every 4 weeks and

testing with the Beta version will
provide the most stable version
(aside from the stable release) and
will provide you with an extra 4
weeks of testing time to make sure
that you address any breaking
changes.

● For more information, check out this

link on testing with Chrome versions.
 Chrome Browser Deployment Guide | August 2023 4

Chrome browser cloud management

You can use the Google Admin console at no ● Block suspicious extensions across your
additional cost to manage Chrome Browser on organization and do other common IT tasks.
Windows, Mac, and Linux devices running
● View reports on Chrome Browsers deployed
Chrome Browser version 73 or later.
across your organization, including each
With Chrome Browser Cloud Management, browser's current version, installed apps
you can: and extensions, and enforced policies.

● Enforce 300+ Chrome policies for all ● For instructions on how to enroll
users who open Chrome Browser on a devices and manage Chrome Browser,
managed device. see Set up Chrome Browser Cloud
Management.
● Users don't have to sign in or have Google
Accounts to receive policies.
 Chrome Browser Deployment Guide | August 2023 5

Choosing a management method

Choosing a management method

Google provides two different methods for Here is a link to more information about
managing Windows machines: group policy that feature.
templates and Chrome Browser Cloud
● Steps to setting up Chrome Browser
Management.
Cloud Management are found here.
Here are instructions on managing Mac or
○ A deep verbose guide is located
Linux machines. [Mac] [Linux]
here.
For managing multiple OSs, first consider ● Steps to setting up Windows
Chrome Browser Cloud Management. This management via Group Policy are
feature provides one location to manage located here.
Windows, Mac and Linux at no additional
cost. You also get a view of installed
extensions, plugins and versions of Chrome.

The table below covers some tradeoffs with each solution; but note that both can work side by side.

Pros Cons

Chrome ● No cost ● No on-prem option and

Browser Cloud must connect to the
Management ● Additional reporting
internet to fetch policy
● Extensions

● Versions

● Applied Policies

● And more

● Supports Windows, Mac,

Linux, IOS and Android

● New features arrive automatically

● Ease of use
 Chrome Browser Deployment Guide | August 2023 6

Pros Cons

Group Policy ● does not require internet ● Some policies are difficult
Objects connection to apply policy to use (require JSON)
or other
local machine ● Already in use for many ● Need to manually update
management
enterprises templates when new
policies are released

● No reporting/ visibility on
chrome versions or
installed extensions

● Platform Specific

1 ● If you are just starting it's recommended you

pick a single method of management.

2 ● If you already have management via GPO and

want to evaluate Chrome Browser Cloud
Management, you can run both tools side by
side and should there be a policy conflict
your GPO policies will take precedence.

● You can also swap this policy

precedence should you wish.
For more information about policy
precedence and merging policies
check out this link.
 Chrome Browser Deployment Guide | August 2023 7

Chrome Policy templates

(Windows, Mac and Linux)

Chrome policies are applied differently depending

on the client operating system.

After selecting the right template for the target

environment, the administrator needs to define
which Chrome policies will be enforced in the
enterprise environment. The Chrome enterprise
policy page lists the supported policies for Chrome
Browser and can be applied via policy templates.

● For information about how to install and

configure policy templates, see Set Chrome
Browser policies on managed PCs.

Windows

For managing Chrome on Windows devices, you There are three types of Chrome policy templates
have the choice of using Chrome Browser Cloud released: Stable, Beta, and Dev.
Management (recommended as a best practice)
1 ● With Beta and Dev templates, you get
or use ADM or ADMX templates to manage
access to policies that are scheduled for
Chrome Browser using Group Policy.
future releases.
● One of the downsides of using Group policy
2 ● This lets you test policies that are not yet
is that ADM and ADMX templates do not
available in the Stable template.
automatically update.
● Whichever template channel you use,
● You need to download and install the latest
the policies that you configure apply to
administrative templates.
all Chrome Browser releases: Stable,
● In Chrome Browser Cloud Beta, Dev, and Canary.
Management, new policies and
3 ● There are also separate templates for Chrome
features are automatically added.
Browser, Google Update, and LBS policies that
you might need to manage your Chrome
Browser deployment.
 Chrome Browser Deployment Guide | August 2023 8

MacOS

Download the enterprise installer (offered in both

a PKG or DMG format) via the Chrome browser
enterprise Mac download site.

● Use a .plist (property list) file to set Chrome

policies or use tools like Jamf or Workspace
One or preferred systems management tools
to push the file to client Macs.

● For instructions on how to manage Chrome

Browser on Mac computers, see the Mac
Quick Start Guide.

● For information on managing updates on

MacOS review this helpful guide on update
management on Macs.

Linux

Use a JavaScript Object Notation (JSON)

configuration file to set Chrome policies. Use your
preferred systems management tool to push the
file to client PCs.

● For instructions on how to manage Chrome

Browser on Linux Computers, see the
Linux Quick Start Guide.

● For information on managing updates on

Linux, review this helpful guide on update
management on Linux.
 Chrome Browser Deployment Guide | August 2023 9

Cloud user policy

In addition to machine-based policies, you can ● Cloud policies are deployed and updated
optionally provide users with the convenience of anytime the client has internet connectivity.
having their tabs, bookmarks, and themes synced
● Unlike the typical GPO policy push
with any PC where Chrome Browser is installed.
scenario which requires the PC to have
● Additionally, administrators can define LAN or VPN connectivity to the Active
pre-installation of Chrome extensions, Directory controller, cloud policies can
and themes when users sign in to be pushed when the client PC has a
Chrome Browser. connection to the public Internet.

● These cloud policies are defined by ● For information about how to manage
administrators in the Google Admin console policies from the cloud, see
and are set via the same method as Cloud-managed Chrome Browser.
device-based policy in Chrome Browser
Cloud Management. ● Note: By default Machine policies (GPO,
Chrome Browser Cloud management
● Note that devices that are enrolled in policies) take precedence over cloud
Chrome Browser Cloud management policies when there’s a conflict.
do not require the user to sign into a
Google account in the browser in order ● You can also swap this policy
to be managed and receive policy. precedence should you wish.
For more information about policy
● These policies apply to users on any platform
precedence and merging policies,
where the user signs in to Chrome Browser
check out this link.
with their Google Account.

● If you’re a Google Workspace customer

or have Chrome OS licenses, you can
use cloud user policies to manage
Chrome Browser for your users.
 Chrome Browser Deployment Guide | August 2023 10

Chrome Browser
Development
Introduction

Enterprise software deployments require a phased

roll-out to capture and resolve any issues before
deploying the software company-wide.

● We recommend you deploy Chrome Browser

in a structured approach with the following
phases: Development, Partial Deployment,
and Full Deployment.

● This multi-step approach allows you to

evaluate the deployment at each stage
and make necessary changes.

● Below are some of the tasks that

should be performed in each Chrome
Browser.

Development Partial Development Full Development

● Testing policies ● Identifying a subset of ● Deploy to the entire

● Incorporating Chrome browser platforms, users and/or user-base
into your base image business groups to test
the deployment
● Reviewing change
management policies
 Chrome Browser Deployment Guide | August 2023 11

Preparing your environment for managed Chrome

Before applying policies, it's a good idea to see how Viewing Policy and applied Plugins
your users use Chrome today. Once you have this
The console’s device view is under
information, plan to roll out policies slowly. This helps
Devices>Chrome Browser>Managed browsers>
increase productivity and security, with minimal
click on an enrolled browser.
end-user disruption. Here are some steps to provide
This section provides details about:
more visibility into user activity:
● Versions of Chrome, profiles, extensions,

Using Chrome Browser applied policies and plugins

Cloud Management’s Reporting ● Try selecting a device in each

The best way to start managing extensions is to first geolocation, department, etc,
get some data — data on extensions, policies, plugins and look at what policies and extensions
and versions of Chrome that your users are utilizing. are present.
The easiest way to do this is through: ● This will provide a good idea on what
users commonly use so
● Enrolling your browsers into Chrome Browser
you can set up policies per organization
Cloud Management
unit within
● Enabling cloud reporting in Chrome the console.
Browser Cloud Management ● For more information about setting up
Here are some features that can help you get insight Organizational Units
into how Chrome is used in your enterprise: in the Google Admin Console, refer to this
link.

Apps and Extensions usage report

This will provide you with insight into what extensions
are installed and what rights they require to run.

● For additional information about extensions, you

can use the console’s new Takeout API to pull all
of this information out of the console into
a CSV file.

● For more information on the Takeout API,

please visit this link.
 Chrome Browser Deployment Guide | August 2023 12

Preparing your installation package

Chrome Browser installations from an MSI package Logging

are installed at the system level and are available to You can increase logging for Windows installation
all users. As a result, any user-level installation of to troubleshoot problems and refer to the logs
Chrome Browser, (i.e. a user’s own Chrome Browser of your distribution software to log successful
installation), will be overridden. Here’s where Chrome and failed installations. You can also use the logs
Browser is installed and linked for the two types of created by the Chrome Browser installation to
Chrome Browser installers: troubleshoot errors.

● User Level: “%USER ● For more information about the different

DATA%\Google\Chrome\Application\” methods of logging, take a look at the

● System Level: “Program Chrome Browser Debug log guide.

Files\Google\Chrome\Application\” ● Review these guides for troubleshooting

Chrome Crashes and performance
Note: Chrome Browser won’t support an older
issues and some tips on how to fix
version to be installed over a newer version. Any MSI
installation issues.
of Chrome Browser needs to be newer than the
version already deployed (for example, Chrome 68 ● The Chrome MSI itself can also be configured
cannot overwrite Chrome 69). to increase its logging verbosity to provide
more clarity on the success or any failure.
Test your Installation Process
It’s important to understand why a particular
Some users might have downloaded and installed installation of the MSI failed.
Chrome Browser before your enterprise installation,
and there will be a previous “user level” installation. ● Separately, the logs created by the
Chrome Browser installation are
● In this case, Chrome Browser will install for all defaulted to the highest verbosity
users and leave the user data (preferences, level and located here:
cache, etc.) untouched, unless you choose to
have your distribution software uninstall any ● %TEMP%\chrome_installer.log
previous installations.
● Important: %TEMP% should
● It will also attempt to repoint all of the be the System temp directory and
default shortcuts to point to the new not the user-level system
system level installation. variable.

Important: Test your Chrome Browser installation

process to make sure it works correctly on your
organization’s Windows or Mac image and method
of software distribution.
 Chrome Browser Deployment Guide | August 2023 13

Chrome Updates

● The initial Chrome installation is approximately ● If you must turn off auto-updates, have a
56 MB. process to ensure timely updates throughout
your network.
● Subsequent updates from one version to
the next are approximately 10–15 MB. ● Have a plan to re-enable auto-updates
as soon as possible
● Patch updates are typically 0.5–3 MB.

● Updates from a major version to a later The Google update engine

non-consecutive major version usually Chrome uses an update engine called Google
requires a new complete installation Update. While you can configure the update
(done automatically by Google Update). frequency, it’s important to understand what
logging options are available when troubleshooting
It is recommended as a best practice to keep
updates to Chrome Browser.
auto update on for all of your users to receive
critical security fixes and new features as they ● For more information about logging Chrome
become available. Update issues, check out this Chrome
● No need to manually deploy each Update guide’s troubleshooting section.
release/security patch or centrally manage
them; the browser will update itself
Note: that if you are managing via local machine
● For less frequent updates, you don’t need policy (like using GPO), that
to disable updates altogether. Instead, you Google update has its own set of policies that are
have two options: separate from the other Chrome browser policies.
● Put users on the Extended Stable channel If you manage Chrome in the Google admin
to receive a new major version every 8 console then all of the policies are located
weeks. Here is a link for more information together.
about the channels of Chrome. ● Here is a link with more information about the
● Pin to a specific version of Chrome until Google Update policies template.
you have vetted a new version. ● For more information on managing
● Allows for automatic rollback to a Chrome Updates policies, check out
previous version this update strategy doc that covers
all of the options.
● Reduces the risk of crashes and
security vulnerabilities
 Chrome Browser Deployment Guide | August 2023 7

Getting started with

Browser Policies
Regardless of the amount of management you want to apply,
there are three common policy categories that most
enterprises implement.

Making Chrome the Default browser (optional)

For more information on how to make Chrome the

default browser on Windows 10 or higher, please
refer to this Chrome default browser guide.

Security

Chrome by default is one of the most secure

browsers on the market. The best way to protect
your users is to leave the default settings of
Chrome on.

Need additional information about the

security settings? Review the Google Security
Configuration Guide for best practices.

● A 3rd party guide written by Center

for Internet Security is also available.
 Chrome Browser Deployment Guide | August 2023 15

Privacy Settings

The Google Chrome Privacy Notice describes If you are concerned about personally identifying
how we treat personal information when you use data remaining in Chrome, you might want to
Chrome Browser and associated services such as consider reviewing the Browsing Data lifetime
Safe Browsing. and ClearBrowsingDataOnExitList policies that
can automatically clear out data from the browser
● You can review the latest version via the link
on exit or after a specified time period.
above, which outlines the data collected
based on the feature being used. ● You can also refer to the Chrome Browser
Enterprise Security Configuration guide
● Note that in many cases, specific features can
that advise on how to:
be disabled by the user or via policy to
minimize the information sent to Google. ● Manage settings to reduce security
These include but are not limited to: threats to your enterprise

● Chrome Sync with SyncDisabled ● Manage security for your users'

● Omnibox search suggestions with personally identifiable information
SearchSuggestEnabled
● Evaluate how security and privacy
● Translate feature with TranslateEnabled relate to Chrome management
and performance
● Spellcheck feature with
SpellCheckServiceEnabled

● Autofill feature with

AutoFillEnabled,AutofillCreditCard
Enabled

● Anonymous usage statistics and

crash reports to Google with
MetricsReportingEnabled
 Chrome Browser Deployment Guide | August 2023 16

Unified end-user Experience

Want to provide the best experience for your users?

Consider applying some productivity policies.

You can find all of the policies that you can apply
in Chrome at the policy page.

Initial Preferences for Chrome Browser

Administrators can use master preferences to Note: For Chrome browser 91 or later, the file
deploy default preferences to Chrome Browser named initial_preferences replaces the
users on managed computers. master_preferences file.

1 ● When users launch Chrome for the first time, ● To minimize disruption, Chrome continues
the user’s preference file is copied from the to support both filenames, and any further
initial_preferences file. change will be notified in the Chrome
Enterprise release notes.
2 ● We recommend you validate the
initial_preferences file with a JSON validator
and formatter before deploying.

3 ● After the initial_preferences file has been

verified, package it with the Chrome
installation for deployment.

● For information about how to deploy initial

preferences on users’ computers, check
out this link for more information.
 Chrome Browser Deployment Guide | August 2023 16

Legacy browser support

If your organization wants to take advantage of the

Chrome Browser, but your users still need to
access legacy websites and web apps that require
Microsoft Internet Explorer (or Safari on Macs), you
can use Legacy Browser Support to easily switch
between browsers.

When users click a link in Chrome Browser that

requires a legacy browser to open (such as a
website with an embedded ActiveX control), the
URL will automatically open in IE mode in
Microsoft’s Edge browser. Administrators can
specify which URLs to launch into IE mode and
deploy this Chrome policy for the organization.

● For information, see Legacy Browser

Support for Windows.

● For Mac support, see Legacy Browser

support on Mac.

Extension management

Extensions are popular with end users. Managing

them can be a challenge. For a complete guide on
managing extensions, check out Managing
Extensions in your Enterprise.
 Chrome Browser Deployment Guide | August 2023 10

Get support

Chrome Browser Enterprise Support

Google offers a paid support offering called Chrome

Browser Enterprise Support. It provides 24/7 phone,
email and portal support for troubleshooting issues
and assistance on management configuration
questions. For more information, please visit this site.

If you already have any Google Services like Google

Cloud, Workspace or ChromeOS licenses, you might
be entitled to support for Chrome browser as well.

● Check out this blog on all of the support

options available for Chrome browser.

Google Help Center

The Help Center is the primary source for all of the

supporting documentation.

Chromium.org

The Chromium Projects is where you can submit

possible bugs or feature requests to be included or
fixed with upcoming versions of Chrome Browser.
 Chrome Browser Deployment Guide | August 2023 10

Resources

Setting up Chrome Browser Cloud Management

Chrome Browser Cloud Management Deployment Guide

Chrome Browser Policy List

Chrome update management strategies

Managing Extensions in your Enterprise Guide