www.inthecloud247.com Open in urlscan Pro
109.237.219.55 Public Scan

Back to summary

URL:
https://www.inthecloud247.com/manage-google-update-settings-with-microsoft-intune/
Submission: On January 31 via manual (January 31st 2024, 11:17:03 am UTC) from GB — Scanned from NL

Form analysis
2 forms found in the DOM

GET https://www.inthecloud247.com/

<form role="search" method="get" class="search-form" action="https://www.inthecloud247.com/">
  <label>
    <span class="screen-reader-text">Search for:</span>
    <input type="search" class="search-field" placeholder="Search …" value="" name="s">
  </label>
  <input type="submit" class="search-submit" value="Search">
</form>

POST https://www.inthecloud247.com/wp-comments-post.php

<form action="https://www.inthecloud247.com/wp-comments-post.php" method="post" id="commentform" class="comment-form" novalidate="">
  <p class="comment-notes">Your email address will not be published.</p>
  <p class="comment-form-comment"><label for="comment">Comment</label><br><textarea id="comment" name="comment" cols="45" rows="5" aria-required="true"></textarea></p>
  <p class="comment-form-author"><label for="author">Name </label><span class="required">*</span><br><input id="author" name="author" type="text" value="" size="30" aria-required="true"></p>
  <p class="comment-form-email"><label for="email">Email </label><span class="required">*</span><br><input id="email" name="email" type="text" value="" size="30" aria-required="true"></p>
  <p class="comment-form-url"><label for="url">Website</label><br><input id="url" name="url" type="text" value="" size="30"></p>
  <p class="comment-form-cookies-consent"><input id="wp-comment-cookies-consent" name="wp-comment-cookies-consent" type="checkbox" value="yes"><label for="wp-comment-cookies-consent">Save my name, email, and website in this browser for the next time
      I comment.</label></p>
  <p class="form-submit"><input name="submit" type="submit" id="submit" class="submit" value="Post Comment"> <input type="hidden" name="comment_post_ID" value="5221" id="comment_post_ID">
    <input type="hidden" name="comment_parent" id="comment_parent" value="0">
  </p>
  <p style="display: none;"><input type="hidden" id="akismet_comment_nonce" name="akismet_comment_nonce" value="7a344f0a05"></p>
  <p style="display: none !important;"><label>Δ<textarea name="ak_hp_textarea" cols="45" rows="8" maxlength="100"></textarea></label><input type="hidden" id="ak_js_1" name="ak_js" value="1706699816818">
    <script>
      document.getElementById("ak_js_1").setAttribute("value", (new Date()).getTime());
    </script>
  </p>
</form>

Text Content

Manage Cookie Consent

To provide the best experiences, we use technologies like cookies to store
and/or access device information. Consenting to these technologies will allow us
to process data such as browsing behavior or unique IDs on this site. Not
consenting or withdrawing consent, may adversely affect certain features and
functions.
Functional Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose
of enabling the use of a specific service explicitly requested by the subscriber
or user, or for the sole purpose of carrying out the transmission of a
communication over an electronic communications network.
Preferences Preferences
The technical storage or access is necessary for the legitimate purpose of
storing preferences that are not requested by the subscriber or user.
Statistics Statistics
The technical storage or access that is used exclusively for statistical
purposes. The technical storage or access that is used exclusively for anonymous
statistical purposes. Without a subpoena, voluntary compliance on the part of
your Internet Service Provider, or additional records from a third party,
information stored or retrieved for this purpose alone cannot usually be used to
identify you.
Marketing Marketing
The technical storage or access is required to create user profiles to send
advertising, or to track the user on a website or across several websites for
similar marketing purposes.
Manage options Manage services Manage {vendor_count} vendors Read more about
these purposes

Accept Deny View preferences Save preferences View preferences
Cookie Policy {title} {title}
Recent posts
* [ November 2, 2023 ] Map network drives on cloud-managed Windows devices
Intune
* [ October 28, 2023 ] The next step in a passwordless Windows experience
Microsoft365
* [ October 25, 2023 ] Enable Copilot in a managed Microsoft Edge browser
Intune
* [ October 12, 2023 ] Hide try the new Outlook toggle the correct way Intune
* [ October 11, 2023 ] Manage printer mappings on cloud-managed Windows devices
Intune

* LinkedIn
* Twitter
* YouTube
* Git
* RSS

PETER KLAPWIJK - IN THE CLOUD 24-7

INTUNE, WINDOWS, OFFICE 365, MICROSOFT 365, AZURE, AUTOMATION

MENU
* Home
* Intune
* Windows
* macOS
* Android
* iOS
* Automation ►
* Power Automate
* Intune Monitoring
* GitHub
* Security ►
* Passwordless
* Security
* Speaking
* About me

* Home
* Intune
* Windows
* macOS
* Android
* iOS
* Automation
* Power Automate
* Intune Monitoring
* GitHub
* Security
* Passwordless
* Security
* Speaking
* About me

December 22, 2023
Search for:
HomeIntuneManage Google Update settings with Microsoft Intune

MANAGE GOOGLE UPDATE SETTINGS WITH MICROSOFT INTUNE

April 21, 2020 Peter Klapwijk Intune, Microsoft Endpoint Manager, Microsoft365,
Windows 14

This is a follow-up post on Managing Google Chrome settings with Microsoft
Intune. In this post I will show how we can use Microsoft Endpoint Manager
(Intune) to manage Google Update settings.

Like the Google Chrome settings, the Google Update settings can also be managed
using a custom configuration profile for Windows 10. The policy consists of two
parts. The first part is used to deploy the Google Update ADMX file to the
Intune managed device. The second part of the policy is used to manage the
settings of choice.

Note: most settings do only work on (Hybrid Azure) AD Joined devices.

DEPLOY THE GOOGLE UPDATE ADMX FILE

The Google Update ADMX file can be downloaded as part Chrome Enterprise bundle.
After downloading the bundle, locate the ADMX file and open the file with a text
editor.

Now open a browser to sign-in to the Microsoft Endpoint Manager portal.

* Sign-in to the Endpoint Manager admin center
* Browse to Devices – Windows
* On the Configurations profiles tab click + Create profile

* Choose Windows 10 and later as Platform
* Choose Custom as Profile type
* Click Create

* Give the configuration profile a Name
* Enter a Description (optional)
* Click Next

* Click Add

With this row we deploy the ADMX file to the Windows 10 device. As you can see
the OMA-URI contains ADMXInstall.
More info on how the OMA-URI is build up and complementing information about
ADMX-backed policies can be read in this article on Microsoft Docs.

Enter below information to the policy;
Name: Chrome ADMX Ingestion
OMA-URI:
./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/GoogleUpdate/Policy/GoogleUpdateAdmx
Data Type: String
Value: As value copy the entire content of the ADMX file in the value field

* Click Add
* Click Next

Assign the profile to a group.

The policy to deploy the ADMX file is ready. In the next steps we add the
settings we manage with Intune to the same policy.

HOW TO BUILD UP THE OMA-URI

As with deploying the ADMX file, for the settings to manage we also need to know
the OMA-URI which we need to use. But the OMA-URI for managing the settings
consists of some information we need to collect ourselves from the Google Update
ADMX file.

This is for example the OMA-URI to manage the Auto Update Check Period:
./Device/Vendor/MSFT/Policy/Config/GoogleUpdate~Policy~Cat_GoogleUpdate~Cat_Preferences/Pol_AutoUpdateCheckPeriod
Let`s split up the OMA-URI in seperate parts.
This is default for managing applications using an ADMX file:
./Device/Vendor/MSFT/Policy/Config/

The part that comes next is not always the same, we need to follow some rules:
GoogleUpdate~Policy~Cat_GoogleUpdate~Cat_Preferences/Pol_AutoUpdateCheckPeriod
It starts with GoogleUpdate (the ADMX file name), like in the ADMXInstall URI,
followed by Policy. Between every part we have the ~ sign.
After Policy we see the name of two categories. These categories can be found in
the Chrome ADMX file.
When we open the ADMX file in a text editor, we can see there are
several categories. The first categorie we find in the ADMX file is the top
category and as we can see that is Cat_GoogleUpdate. We put this in the OMA-URI
after Policy.
Here we also see some sub categories, like Cat_Preferences and Cat_Applications.

If we search the ADMX file for the sub categorie Cat_Preferences, we find the
actual policies we can manage. The policy name of such a setting is the last
part of the OMA-URI, in this case Pol_AutoUpdateCheckPeriod.
Here we also find the Data ID of the setting, which we need later in the
configuration.

MANAGE GOOGLE UPDATE SETTINGS

As example I show two settings; Auto Update Check Period and Update Policy
Google Chrome.

We have already seen how to build the OMA-URI for the policy
Pol_AutoUpdateCheckPeriod, so let`s start with that one. The Data type for these
settings is always String. Than we only need to know what our Value is.

The value starts with <enabled/> (or <disabled/> if you like to disable a
setting).
If we have a setting which can only be set to enabled or disabled, than that`s
the value.

But for Auto Update Check Period, we need to set a value which corresponds to
minutes between update checks. In this case <enabled/> is followed by a data id.
The data id is found again in the ADMX file, in below example the decimal id,
Part_AutoUpdateCheckPeriod.
And as last we need to set a value, which is a number in this case.

Open the Endpoint Manager Portal.

* Open your existing custom policy or create a new policy
* Click Edit next to Configurations settings
* Click Add
* Give the Row a Name
* Fill in the OMA-URI:
./Device/Vendor/MSFT/Policy/Config/GoogleUpdate~Policy~Cat_GoogleUpdate~Cat_Preferences/Pol_AutoUpdateCheckPeriod
* Data type: String
* Value:

* Click Add
* Click Review + Save
* Click Save

That`s it, the first Google Update setting is ready for deployment.

The next example is found under the Google Chrome categorie: Update Policy
override. Open the Chrome ADMX file and search for UpdatePolicyGoogleChrome.
With the information found in the ADMX file we can create the OMA-URI.
Here we find the policy name and the sub categorie. Cat_GoogleChrome is a
categorie not directly located under the top categorie Cat_GoogleUpdate, there
is a categorie between those. If we search back in the ADMX file, we see that
the categorie between these is Cat_Applications.
We also find the Data id in the ADMX file and the values we can set are here
located. We have four options we can set, I prefer to set Automatic Updates
Only, I use the corresponding value 3 in my policy.

Open the Endpoint Manager Portal to add an extra row.

* Click Add
* Give the Row a Name
* Fill in the OMA-URI:
./Device/Vendor/MSFT/Policy/Config/GoogleUpdate~Policy~Cat_GoogleUpdate~Cat_Applications~Cat_GoogleChrome/Pol_UpdatePolicyGoogleChrome
* Data type: String
* Value:

* Click Add
* Click Review + Save
* Click Save

Another example under the category Applications is
Pol_TargetVersionPrefixGoogleChrome. This setting specifies which version Google
Chrome should be updated to.
The data id for this policy setting is Part_TargetVersionPrefix. And the value
is the Chrome version to which the browser needs to be updated to.

The OMA-URI is:
./Device/Vendor/MSFT/Policy/Config/GoogleUpdate~Policy~Cat_GoogleUpdate~Cat_Applications~Cat_GoogleChrome/Pol_TargetVersionPrefixGoogleChrome

Value:

Add all the required settings of your choice and switch over to the Windows
device.

THE END RESULT

The end-result is pretty short.
If the deployed settings are successful applied you can find this under the
Settings. Browse to Accounts, Access work or School. Click on your account and
click Info.
Here we see the two settings we have deployed.

If we have a look at the registry, we find the same settings under
HKLM\Software\Policies\Google\Update

And when we open Google Chrome and enter Chrome://policy in the address bar we
find the configured settings.
In the top right corner we can search for settings.

Thank you for reading. I hope you find it informative and if you have any
question, please leave a comment.

1. Manage Google Chrome settings with Microsoft Intune
2. Manage Mozilla Firefox settings with Microsoft Intune
3. Manage Mozilla Firefox proxy settings with Microsoft Intune
4. Manage Internet Explorer settings with Intune

* Administrative Templates
* Azure AD
* Browser
* EMS
* Google Chrome
* Intune
* Microsoft 365
* Microsoft Endpoint Manager
* Windows10

Add an Azure AD group to the local administrators group with Microsoft Intune

Microsoft Whiteboard; We couldn`t sign you in

14 COMMENTS

1. Dilip says:
April 28, 2020 at 07:30

Hi Peter,

I have a windows 10 device joined in Azure active directory.

I wanted to restrict Google Update to specific version Example: Chrome 80
version

./Device/Vendor/MSFT/Policy/Config/GoogleUpdate~Policy~Cat_GoogleUpdate~Cat_Applications~Cat_GoogleChrome/Pol_TargetVersionPrefixGoogleChrome

I have configured above in intune device configuration.

The policy is getting pushed but Google Chrome still updates to latest
version..

Any help what setting is required to control the chrome update to specific
version?

Thanks
Peter

Reply
* Peter Klapwijk says:
April 28, 2020 at 17:06

Hi Dilip,

I`ve not tested that particular setting.
Another approach could be to set Update policy override to Updates
disabled and deploy the Chrome version of your choice to the devices. When
a newer version is tested by you, deploy the next version.

Reply
* Dilip says:
April 29, 2020 at 21:40

Thanks for your reply Peter.
The another approach you mentioned is via GPO right? The device is not
connected to any domain windows active directory
The device is connected only to azure domain directory.Is it still
possible to disable updates ?

Reply
* Peter Klapwijk says:
April 30, 2020 at 09:24

No, have a look at the example in the post about Update policy
override.
You should set this to 0, to disable the updates.
./Device/Vendor/MSFT/Policy/Config/GoogleUpdate~Policy~Cat_GoogleUpdate~Cat_Applications~Cat_GoogleChrome/Pol_UpdatePolicyGoogleChrome

Reply
* Dilip says:
April 30, 2020 at 20:17

Yea I tried that Peter, UpdateDefault is set to 0 but it didn’t work
for me. When you go chrome about screen it still check for updates.
Expected behaviour should be updates are disabled but it still
updates. Appreciate your help. Thanks

* Peter Klapwijk says:
May 5, 2020 at 09:11

Although the policy settings from Google Update are applied
successful, they seem to have no effect on AAD joined devices.
The description of the Override settings:
This policy is available only on Windows instances that are joined
to a Microsoft® Active Directory® domain.
And indeed, the settings does work on Hybrid AAD joined devices.
I put a note on this to the article.

* Anders Ingebrigtsen Dahl says:
November 25, 2020 at 12:22

Great article!

Don’t know if this has changed recently, but I was able to rollback
to targetversion on AAD joined device.

./Device/Vendor/MSFT/Policy/Config/GoogleUpdate~Policy~Cat_GoogleUpdate~Cat_Applications~Cat_GoogleChrome/Pol_TargetVersionPrefixGoogleChrome

./Device/Vendor/MSFT/Policy/Config/GoogleUpdate~Policy~Cat_GoogleUpdate~Cat_Applications~Cat_GoogleChrome/Pol_RollbackToTargetVersionGoogleChrome

2. Dilip says:
May 12, 2020 at 21:02

Thanks Peter for confirming. Keep up the good work. You have helped lot of
people from your article with wide range of topics.

3. Kelly says:
August 6, 2020 at 20:21

I have been pulling my hair out trying to figure out why this is not working
on my AAD devices. Has anyone found a workaround? I need to keep my
endpoints on the previous versions of Chrome for at least a couple weeks
while QA continues to test our home grown applications.

4. Vishnu ketineni says:
August 12, 2020 at 10:07

Hi Peter,
I want to update the google chrome to the latest. how I can achieve that?
Thank you

5. mdowst says:
June 21, 2021 at 16:19

This was exactly what I was looking for because the Google KB was very much
lacking in details. It worked like a charm. Thanks!

6. dkernus says:
September 2, 2021 at 21:24

I followed the instructions here and the configuration deployed successfully
through Endpoint Manager to my Windows 10 AAD endpoints, but the Chrome
version appears to be stuck on the version it was on when the config
deployed. Any advice?

7. O says:
November 29, 2022 at 11:00

Hello,
Why not set only those two:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update]
“AutoUpdateCheckPeriodMinutes”=dword:00000078
“UpdateDefault”=dword:00000003

8. Reed says:
September 25, 2023 at 15:02

I have used the same settings. However, Chrome Apps are also getting
installed.
Is there a way to restrict the installation of those apps or a way to block
those application from installing?
Example: Google Drive, YouTube, Sheet, docs, Gmail, Slides.

www.inthecloud247.com Open in urlscan Pro 109.237.219.55 Public Scan

Form analysis 2 forms found in the DOM

GET https://www.inthecloud247.com/

POST https://www.inthecloud247.com/wp-comments-post.php

Text Content

www.inthecloud247.com Open in urlscan Pro
109.237.219.55 Public Scan

Form analysis
2 forms found in the DOM