How to block automatic Google Chrome updates
While it is usually not a good idea to block updates of web browsers such as Google Chrome because of security implications that go along with it, there may be cases where you want more control over the updating.
Many programs ship with options to block updates, but Google Chrome is not one of them. This is different from the behavior of most web browsers, as they do ship with options to set updates to manual for instance. This would give the user full control over the updating, and ensure that updates won't be installed automatically on computer systems.
Please note that Google Chrome is only auto-updated on Windows and Mac Os X machines, and not on Linux.
Block automatic Chrome updates on Windows
As mentioned already, Chrome does not ship with a preference that you can flip to block program updates. There is an option however, and it involves setting a Registry key and installing the Google Update policy administrative template.
Best case scenario is the following one: if the computer is connected to an Active directory domain, all that is required is to set the following Registry value:
- Tap on the Windows-key on the computer keyboard, type regedit.exe, and hit the Enter-key.
- Confirm the UAC prompt.
- Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update
- If Google and/or Update don't exist, create the keys with a right-click on the previous one and the selection of New > Key from the context menu.
- Set the value AutoUpdateCheckPeriodMinutes to 0.
- If the value does not exist, right-click on Update and select New > Dword (32-bit) Value.
This disables update checking. Note that Google resumes updating checking automatically for any computer that is not joined to an Active Directory domain. The period is reduced to 77 hours in this case.
If that is the case, you need to override updates by setting the "update override policy" that is part of the Google Update administrative template.
Note that this works only on professional or Enterprise versions of Windows, and not Windows 10 Home as Group Policy is not part of Home editions of Windows.
Here is how that is done
- Download the Google Update administrative template XML-based file from this Google support page.
- Extract the contents of the archive, and copy it to C:\Windows\PolicyDefinitions.
- Load the Group Policy Editor: tap on the Windows-key, type gpedit.msc, and hit the Enter-key.
- Navigate to Computer Configuration > Administrative Templates > Google > Google Update > Google Chrome.
- Double-click on "update policy override".
- Switch the policy to enabled. You can set the update behavior of the web browser to one of the following four options:
- Always allow updates (recommended) -- this is the default behavior.
- Automatic silent updates only -- updates are applied only when they are found via periodic update checks.
- Manual updates only -- updates are only applied when users check for updates manually in the interface.
- Updates disabled -- this turns off updates so that they are never applied.
- Click ok to finalize the policy change and close the Group Policy editor afterwards.
Caution
If you disable Chrome updates, your only options to update the browser are to run a manual check for updates in the browser, or check for a new version manually on Google's Chrome blog, or on third-party sites that write about these updates.
Additional information on turning off auto updates in Google Chrome is available on the Chromium Projects website.
Now You: Do you prefer automatic updates, or manual updates?
Always manual updates for everything and only after a careful consideration. My computer, my rules :)
I also prefer manual updates. Because newer doesn’t automatically mean better. :)
How do you keep track of everything? I use a filehippo app manager scheduled to run daily to notify then use chocolatey to update, but it can be a nuisance. I tried other automatic updater like secunia, but they are either unreliable b/c they don’t properly detect all software or they are slow and resource intensive.
I use my memory :) But I prioritize applications with a greater security risk (browsers for instance) and that makes it a bit easier.
Browsers are easy enough. How about other things likes 7 zip, python, open vpn, various audio and music players etc? 7 zip for example had a huge exploit a while back and the only reason I knew about it was b/c it was mentioned on Ghacks. It didn’t help that 7zip updates so infrequently so it is a out of sight, out of mind type of programs.
Sounds like a real hassle to do this. But then I don’t use crap spyware like Google Chrome.
You could also do the following:
Launch Task Manager
Kill Process for GoogleUpdate.exe if running
Then rename GoogleUpdate.exe in the Google Chrome\Update folder to GoogleUpdate.old it will never run again to update, you will also get an error message when you go to update Chrome that says contact your System Administrator.
This is an abysmally bad idea. I understand that you want “control” over your machine, but honestly you are just shooting yourself in the foot. The web platform is very rapidly changing with new features being released monthly at times. The only thing you are achieving by doing this is having some false sense of control, while opening yourself up to a load of exploits, as well as getting a generally crappy experience online.
What a load of crap. In a corporate environment with several hundred users, control of the deployed version of Chrome by the IT Department is necessary. Not doing that is an abysmally bad idea.
Does micro soft allow roll backs on Chrome?
The template says for Windows Vista, it won’t hurt my Windows 10 computer? Thanks.
Success on a Mac Sept 29, 2017:
The “official” Google-given method given is this, but it doesn’t work.
In Terminal: defaults write com.google.Keystone.Agent checkInterval 0
The most foolproof method is to deny Chrome the permissions it needs to install the update software and run it. Empty these directories:
/Library/Google/GoogleSoftwareUpdate/
~/Library/Google/GoogleSoftwareUpdate/
Then change the permissions on both folders named GoogleSoftwareUpdate so that there’s no owner and no read/write/execute permissions.
In terminal:
cd /Library/Google/
sudo chown nobody:nogroup GoogleSoftwareUpdate
sudo chmod 000 GoogleSoftwareUpdate
cd ~/Library/Google/
sudo chown nobody:nogroup GoogleSoftwareUpdate
sudo chmod 000 GoogleSoftwareUpdate
If you want to be double-certain, then do the same for the folder Google one level up.
cd /Library/
sudo chown nobody:nogroup Google
sudo chmod 000 Google
cd ~/Library/
sudo chown nobody:nogroup Google
sudo chmod 000 Google
I did this immediately after installing the Chrome version I need for my machine, and it worked perfectly. Now when I check About Google Chrome it gives me the error “Update failed (error: 10)” It’s still trying to update, but it can’t do it any more.
Thanks a lot for truly helpful post!
I saw those settings in other places but i had non of them in my PC, Registry or GPs, so using your tips i manually got it done.
actually, i did disable gupdate and gupdatem (manual) from Services. And some creepy registry named such gupdate,..but your solution is the way.
Cheers, Shahriyar.
Super Thanks. works fine
damn, it took a while to do it
the last strow for me was the remove of mute_tab flag, no way i can stay without it
offline version 70 and that`s it
good bye google updates