1

I'ved edited the Host file in an effort to block users from installing chrome with no luck.

3
  • 6
    What's wrong with Chrome?
    – fideli
    Jul 26, 2011 at 17:17
  • Might be an issue with not wanting users to run untested software in a corporate environment. Due to chrome's frequent updates, it might be hard for them to fully test the updates before users apply them. Jul 26, 2011 at 18:05
  • 1
    Is the computer on a managed domain? Are you admin on the machine(s)? Jul 26, 2011 at 18:11

3 Answers 3

4

You can't.

The short of the matter is if a user is allowed to run executable code (i.e., launch programs) and can move data to the target system (flash drive, CD, email, websites, shared network drives, etc.), then they can run any program they wish within their security restrictions. Since there's no real way to create a security restriction that would hit chrome without hitting every other webbrowser (IE, Firefox, Safari, Opera, etc.), you cannot effectively do what you're asking.

You can try a number of tricks to inhibit the installation, but they are all easily circumvented.

1

Lot of things you can do, none are foolproof.

  1. blacklist chome.exe, or its hashes (downside is you have to update all the hashes, and they can change the name.
  2. whitelist application that can run by hash/name (downside is its hard and long, and overly restrictive)
  3. dont allow any .exe files to be downloaded (curcumvent with flash drive)
  4. Also, see here

In short, this is really a generic "how do I stop x from running", but I cant seem to find any of those on superuser.

4
  • 1
    2 is the only one that would have a hope of working, and that would be insanely intense to record the hash of every valid executable on the system. Even then you could probably create a hash collision depending on what Windows uses (MD5?) Jul 26, 2011 at 17:25
  • Its possible, but then again, how much effort/expertise is available to the user? in addition getting hash collision for some text is easy, for a program its harder, as it still has to behave correctly (though its still doable, probably just by editing the headers somehow)
    – soandos
    Jul 26, 2011 at 17:27
  • 1
    I've personally seen all but #2 broken by the most computer-illiterate highschool students (I maintained and managed several computer labs at my school). THEY WILL FIND A WAY (cue Jurassic Park music) Jul 26, 2011 at 17:30
  • And its a pain to maintain.
    – soandos
    Jul 26, 2011 at 17:31
0

To restrict from installing software in your laptop click on the start menu, select search and in the space provided type “gpedit.msc”then click the search button. This opens the group policy editor. then go to computer configurations and then click on administrative templates. Here select windows component and then browse to windows installer components. Double click on “disable windows installer”.from here you can make changes in the configuration and give rights to users.
Or install “software block”a software that allow administrator to set password for installing new software.

Or take a look on this Link.

1
  • Chrome.exe can just be copied to the target computer, creating no need to use windows installer and circumventing the software block because no password is needed to write to your own user folder. Jul 26, 2011 at 17:22

Not the answer you're looking for? Browse other questions tagged .