up vote 1 down vote favorite
share [g+] share [fb]

I'ved edited the Host file in an effort to block users from installing chrome with no luck.

link|improve this question
6  
What's wrong with Chrome? – fideli Jul 26 '11 at 17:17
Might be an issue with not wanting users to run untested software in a corporate environment. Due to chrome's frequent updates, it might be hard for them to fully test the updates before users apply them. – Darth Android Jul 26 '11 at 18:05
1  
Is the computer on a managed domain? Are you admin on the machine(s)? – music2myear Jul 26 '11 at 18:11
feedback

closed as not a real question by Nifle, nhinkle♦ Jul 26 '11 at 19:23

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. See the FAQ for guidance on how to improve it.

3 Answers

up vote 4 down vote

You can't.

The short of the matter is if a user is allowed to run executable code (i.e., launch programs) and can move data to the target system (flash drive, CD, email, websites, shared network drives, etc.), then they can run any program they wish within their security restrictions. Since there's no real way to create a security restriction that would hit chrome without hitting every other webbrowser (IE, Firefox, Safari, Opera, etc.), you cannot effectively do what you're asking.

You can try a number of tricks to inhibit the installation, but they are all easily circumvented.

link|improve this answer
feedback
up vote 1 down vote

Lot of things you can do, none are foolproof.

  1. blacklist chome.exe, or its hashes (downside is you have to update all the hashes, and they can change the name.
  2. whitelist application that can run by hash/name (downside is its hard and long, and overly restrictive)
  3. dont allow any .exe files to be downloaded (curcumvent with flash drive)
  4. Also, see here

In short, this is really a generic "how do I stop x from running", but I cant seem to find any of those on superuser.

link|improve this answer
1  
2 is the only one that would have a hope of working, and that would be insanely intense to record the hash of every valid executable on the system. Even then you could probably create a hash collision depending on what Windows uses (MD5?) – Darth Android Jul 26 '11 at 17:25
Its possible, but then again, how much effort/expertise is available to the user? in addition getting hash collision for some text is easy, for a program its harder, as it still has to behave correctly (though its still doable, probably just by editing the headers somehow) – soandos Jul 26 '11 at 17:27
1  
I've personally seen all but #2 broken by the most computer-illiterate highschool students (I maintained and managed several computer labs at my school). THEY WILL FIND A WAY (cue Jurassic Park music) – Darth Android Jul 26 '11 at 17:30
And its a pain to maintain. – soandos Jul 26 '11 at 17:31
feedback
up vote 0 down vote

To restrict from installing software in your laptop click on the start menu, select search and in the space provided type “gpedit.msc”then click the search button. This opens the group policy editor. then go to computer configurations and then click on administrative templates. Here select windows component and then browse to windows installer components. Double click on “disable windows installer”.from here you can make changes in the configuration and give rights to users.
Or install “software block”a software that allow administrator to set password for installing new software.

Or take a look on this Link.

link|improve this answer
Chrome.exe can just be copied to the target computer, creating no need to use windows installer and circumventing the software block because no password is needed to write to your own user folder. – Darth Android Jul 26 '11 at 17:22
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.