Manage Chrome updates (Windows)

Use an administrative template to install and define policies for Google Update. Microsoft Windows 7 and later supports both ADM and ADMX templates. Download the appropriate Google Update policy template for your Windows network:

Microsoft Windows Vista and later

1. Download and unzip the administrative template XML-based (ADMX).
2. Open the GoogleUpdateAdmx folder.
3. Copy google.admx and GoogleUpdate.admx and put them in your Policy Definitions folder. (Example: C:\Windows\PolicyDefinitions)
4. In the GoogleUpdateAdmx/en-US folder, copy the google.adml and GoogleUpdate.adml files and put them in the en-US folder in Policy Definitions. (Example: C:\Windows\PolicyDefinitions\en-US)
5. Open Group Policy and go to Computer ConfigurationPoliciesAdministrative TemplateGoogleGoogle Update to verify that the template loaded correctly.

Microsoft XP

1. Download the administrative template (ADM).
2. Copy the GoogleUpdate.adm file into the Policy Definitions folder. (Example: C:\Windows\PolicyDefinitions)
3. Open Group Policy and go to Computer ConfigurationPoliciesAdministrative TemplateGoogleGoogle Update to verify that the template loaded correctly.

Applies to Chrome browser and all apps managed by Google Update.

Using Group Policy

We recommend that you keep auto-updates turned on so that your users receive critical security fixes and new features as they become available.

In Group Policy (Computer Configuration folder):

1. Go to GoogleGoogle UpdateApplications.
2. Enable the Update policy override default policy.
3. Under Options, choose Allow updates (recommended).
4. Go to GoogleGoogle UpdateApplicationsGoogle Chrome and repeat steps 2 and 3 to make sure auto-updates are also always allowed for Chrome browser.

You can optionally override this setting for an individual app by using the Update policy override policy in the specific app folder.

If you need to stop Chrome browser updates, you can turn off automatic updates and prevent users from manually updating the browser themselves. Even if you turn off updates, Google Update continues to check for new updates.

Important: We do not recommend turning off browser updates. Doing so prevents software fixes and security patches from being applied to Chrome browser. You are also at risk of crashes and security vulnerabilities. If you must turn off updates, make sure you have a process to ensure timely updates throughout your network. Better yet, include a plan to re-enable updates as soon as possible.

In Group Policy (Computer Configuration folder):

1. Go to GoogleGoogle UpdateApplicationsGoogle Chrome.
2. Turn on Update policy override.
3. Under Options, choose Disable updates.

If you turned off Chrome browser updates, check to make sure they’re also turned off on users’ computers:

1. On each user computer, open Chrome browser and at the top, click More Settings.
2. On the left, click MenuAbout Chrome.

You should see a note that updates are disabled by an administrator.

Important: Turning off all app updates prevents software fixes and security patches from being automatically applied to all Google software.

In Group Policy (Computer Configuration folder):

1. Go to GoogleGoogle UpdateApplications.
2. Turn on Update policy override default.
3. Under Options, select Disable updates.

 Even when app updates are turned off, Google Update continues to update itself.

Applies only to Chrome browser components

Even if you turn off updates for Chrome browser, browser components, such as Widevine DRM, won’t automatically stop updating.

In Group Policy (Computer Configuration folder):

1. Go to GoogleGoogle Chrome.
2. Disable Enable component updates in Google Chrome.
3. Click Apply.

Note: This policy does not apply to all components. For a full list of exempted components, see ComponentUpdatesEnabled.

Applies to Chrome browser and all apps managed by Google Update.

Applies only to Chrome browser updates.

You can specify the Chrome browser version (major milestone or specific full version) that you want Windows computers to update to. Google gradually updates computers on the Stable channel to new versions of Chrome browser over a few weeks. Sometimes, updates might take longer.

• Specify the major milestone using the xx. syntax—Computers continue to receive security updates for as long as the milestone that you specified is the major version on the Stable channel. Chrome browser updates to the latest minor release after rollout reaches 100%. This can take a few weeks.
• Specify the full version using the xx.xx.xx.xx syntax—Computers update to the exact version that you specify as soon as it's available.

In general, we recommend that you use the major milestone syntax, xx., to make sure that devices remain on the latest version for that milestone. However, sometimes you might need to specify a certain version using the full version syntax, xx.xx.xx.xx. For example, you might need to deploy a critical security fix and the Google Update ramp rate does not meet business needs. Or, a specific version has been certified based on your organization's internal testing.

Sometimes, minor versions don't reach 100% rollout due to a bug or security fix that requires a new minor version. If you use full version syntax, xx.xx.xx.xx, you're at risk of deploying a version that is not the most recent or has known bugs.

Caution: Pinning updates to a specific version of Chrome browser should be done only temporarily, such as while testing a new version of Chrome browser. Don't forget to unpin users' computers or they can fall behind on critical security updates and miss new features.

Using Group Policy

In Group Policy (Computer Configuration folder):

1. Go to GoogleGoogle UpdateApplicationsGoogle Chrome.
2. Enable Target version prefix override.
3. Under Options, enter the Chrome browser version that you want users to receive.
   If you want to pin updates to the highest available major version, include a period (.) after the version number. For example, enter 90. to allow browsers to update to the highest available version of Chrome 90.
   Note: You can use version numbers with up to 4 parts, such as 90.0.3945.117.

Applies only to Chrome browser updates. Use this policy at your own risk.

To make sure that users are protected by the latest security updates, we recommend that they use the latest version of Chrome browser. Use the Rollback to Target version policy with Target version prefix override to temporarily roll back to a specific version of Chrome browser on Windows computers. By running earlier versions of Chrome browser, you will expose your users to known security issues.

Chrome browser stores a snapshot of user information locally on devices after each major version update. By default, the three most recent snapshots are retained. You can use Group Policy to specify how many snapshots you want to keep on users’ devices. For details, read Keep data during version downgrade.

If you don’t keep snapshots on users devices (Limits the number of user data snapshots retained for use in case of emergency rollback policy is set to 0), each user’s browsing data is automatically deleted unless you do one of the following options:

• Turn on Chrome sync—You can use group policy to turn on Chrome sync for all users or advise them to turn it on themselves. For details, see Force users to sign in to Chrome browser. After you roll back, users need to sign in again to Chrome browser to see their synced information.
• Turn on roaming user profiles—If you turn on the roaming profile policy in Chrome browser, users who sign in to a Windows computer in your organization will automatically see their synced information when they open Chrome browser. For details, see Use Chrome browser with Roaming User Profiles.

Note: You can only use this policy to roll back to the 3 latest major releases of Chrome browser. For information about how to downgrade to earlier Chrome browser versions, see Downgrade your Chrome version.

Using Group Policy

In Group Policy (Computer Configuration folder):

1. (Recommended) Turn on Chrome sync for all users in your organization.
2. Go to GoogleGoogle UpdateApplicationsGoogle Chrome.
3. Enable Rollback to Target version.
4. Click OK.
5. Enable Target version prefix override.
6. Under Options, in the Target version prefix box, enter the release number of the major version of Chrome browser that you want users to roll back to. For example, enter 89. to roll back to the latest release of version 89.
7. Click OK.

Applies only to Chrome browser updates.

Starting in Chrome version 90, Google Update lets you choose the Stable, Extended stable, Beta, or Dev Chrome browser channel. By default, Chrome follows updates on the Stable channel.

For information to help you decide which channel to have your users on, go to Chrome browser release channels.

Things to consider

• Moving to a more stable channel— When you move a browser to a more stable channel, such as from Beta to Stable, the more stable channel is likely to have a lower version number.
  For example, Stable is on version 90 when Beta is on version 91. By default, Chrome will wait to switch channels until a higher version of Chrome is available. It will not downgrade to a lower version.
• Moving to an extended stable channel— When you move to an extended stable channel, we recommend you use the Rollback to Target version policy to let Chrome browser roll back to a previous version. Otherwise, Chrome browser might not get the latest security fixes.
  For example, if you’re on Chrome version 95 and you switch from Stable channel to Extended stable channel, the browser no longer gets security fixes for Chrome version 95. Chrome only gets security fixes when you roll back to Chrome version 94—the previous extended stable version.

• To switch Chrome to a channel with a lower version, set TargetChannel to your desired channel and instruct Chrome to rollback to your desired version. For details, see Roll back Chrome browser to a previous version above.

Set Chrome browser to the Stable or Extended stable channel

1. (Recommended) Turn on Chrome sync for all users in your organization.
2. In Group Policy (Computer Configuration folder), go to GoogleGoogle UpdateApplicationsGoogle Chrome.
3. Enable Target Channel override.
4. Under Options, set Target Channel. Enter the value stable or extended.
5. Click OK.
6. To get Chrome to switch to a more stable channel immediately, enable Rollback to Target version.
7. Click OK.

Applies to Chrome browser and all apps managed by Google Update.

If your organization has an intermediate proxy cache set up on its network, you can use it to cache Chrome browser updates. The updates downloaded from Google can be cached on most web-caching proxy servers. Proxy caches reduce bandwidth and improve response times by caching and reusing frequently requested webpages.

However, many proxy cache default settings aren’t optimal for Chrome browser updates. To make sure that your proxy cache software can cache Chrome browser updates, experienced IT administrators can configure the following settings:

• Maximum file object size— Updates are downloaded as one file, so make sure that the maximum file object size is 100mb.
  
  To cache updates, enable the Google Update policy and set the Download URL class override option to cacheable.
   
• URL settings—If the server allows you to add settings for particular domains, give preference to dl.google.com/* and www.google.com/dl/*. This is where devices get Chrome browser updates.
• Cache space—The total amount of space that the server can use to cache objects. If you have more than 30 GB of cache storage, you can increase the value to cache more objects.

Use Preferences policies to control the default behavior of Google Update.

Using Group Policy

In Group Policy (Computer Configuration folder):

1. Go to GoogleGoogle UpdatePreferences.
2. Enable the policy and set the Options that will govern all the apps listed in Group Policy. (Examples below)
   Note: These policies can be overridden if conflicting policies are set at the app level.

Applies to Google apps only.

Use app policies to control how Google Update interacts with some Google apps. Per-application policies override default policies.

Change default app policies

1. In Group Policy, go to GoogleGoogle UpdateApplications.
2. Open, turn on, and set the policy options for all apps (details below).

Change specific app policies

The Applications folder in Group Policy contains all the Google apps that use Google Update. You can set policies for specific apps.

1. In Group Policy, go to GoogleGoogle UpdateApplicationsapp name.
2. Turn on the policy that you want to change (details below).

If you have trouble with Google automatic updates, gather logs to troubleshoot the problem. 

Create the log file

Windows: System-wide installations

• C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Windows: Per user installations

• %LOCALAPPDATA%\Google\GoogleUpdater\updater.log

After you apply any Google Update policies, users need to restart Chrome browser for the settings to take effect. Check users’ devices to make sure the Google Update policies that you set were applied correctly.

1. On a managed device, go to chrome://policy.
2. Click Reload policies.
3. Check the Show policies with no value set box.
4. Scroll to Google Update Policies.
5. For the policies that you set, make sure that Status is set to OK.
6. For the policies that you set, make sure that the policy values match what you set in the policy.

Depending on the type of installation(s) by the administrator, Google Update will be in one or both of these locations:

• Per machine: %ProgramFiles(x86)%\Google\Update
• Per user: %LOCALAPPDATA%\Google\Update

Google Update runs each hour to see what tasks need to be performed. It evaluates each individual policy setting to determine if a task should be performed in that hour.

For example, if you set the Auto-update check period override policy to change the minimum time period between update checks to 480 minutes, then each hour Google Update checks to see if the last update check was more than 480 minutes ago. If not, Google Update waits for the next hourly run and checks again.

Similarly, you can set an update suppression period (Time period in each day to suppress auto-update check) and each hour Google Update checks if the current time is within the suppression period, if it is then no update is performed and Google Update waits for the next hourly run and checks again.