|
We're about to deploy Google Chrome to our users. The thing is, we use a proxy server to filter HTTP connections to force users to just use a handful of websites on workplace computers. So far I've been able to set Chrome to use either a PAC or configure the Windows LAN settings to use the proxy. The thing is, how do I prevent users from executing Chrome with command line arguments like |
||||
|
|
|
If you are worried about preventing users from changing proxy settings, you probably have a lot worse problems on your hands. If you allow users to execute arbitrary binaries on your systems (or even arbitrary Java applets), people are likely using custom browsers with different configuration settings, anyway. You don't need admin rights to run a browser; there are portable versions of all major browsers which run within the user's home directory and give them permission to change the proxy as they see fit. You should architect your network so that all IP traffic that is not through the proxy gateway is essentially non-routable. That way, you won't care if users change their proxy settings, because it won't get them anywhere except for a dead end. Their only option is to use the proxy, because otherwise, their network packets just go unanswered. That's the most secure architecture. If you are counting on the client to enforce the policy that all network traffic must go through a proxy, and are still allowing people to route "around" the proxy and get to the internet, then you are not implementing an effective architecture. That said, Chrome (when installed in a system folder, not as a regular user) has group policy constraints available which can lock down settings for that instance of Chrome. See this article for info. |
|||
|
|
