Windows – How to disable Google Chrome silent updates

google-chromeupdateswindows

I've done the instructions that I found online and Chrome is still automatically updating itself.

I've downloaded and installed the ADM template so I can use Local Policy to disable updates. I've set it to manual updates only. I've also added keys to the registry at HKLM/SOFTWARE/Policies/Google/Update

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update]
"UpdateDefault"=dword:00000000
"AutoUpdateCheckPeriodMinutes"=dword:00000000
"DisableAutoUpdateChecksCheckboxValue"=dword:00000000
"Update{8A69D345-D564-463C-AFF1-A69D9E530F96}"=dword:00000000
"Install{8A69D345-D564-463C-AFF1-A69D9E530F96}"=dword:00000000

Google Update Services are both disabled. (gupdate and gupdatem)

Best Answer

Google Update Services are both disabled. (gupdate and gupdatem)

This is likely the guilty, as it seems to cause the policy settings to be ignored (source). So you shouldn't disable the services (set both to Manual instead).

Second, a few comments regarding the proposed registry settings:

  • UpdateDefault can be set to 3 in order to prevent updates for all Google software (source)
  • AutoUpdateCheckPeriodMinutes is not interpreted the same when machines are not in a domain (source)
  • Update{8A69D345-D564-463C-AFF1-A69D9E530F96} is a Chrome-specific override for UpdateDefault. Either set to 3 or remove if UpdateDefault is present and set to 3 (i.e., inherit the default)
  • Install{8A69D345-D564-463C-AFF1-A69D9E530F96} is a Chrome-specific override for InstallDefault. Either set to 0 or remove if InstallDefault is specified and set to 0 (i.e., inherit the default)
  • Chrome Binaries policy also needs to exist and the "two need to match in order for auto-update policies to work correctly" (source)

Based in the above, a script was created (which also updates services and scheduled tasks):

@echo off

rem | References:
rem | https://support.google.com/chrome/a/answer/6350036#Registry_Settings
rem | http://stackoverflow.com/a/28356336/1111895
rem | http://superuser.com/questions/645845/how-do-i-disable-google-chrome-silent-updates

echo Stopping and setting Google Update services to manual . . .
rem | don't disable the services as it seems to cause the policy settings to be ignored
rem | https://bugs.chromium.org/p/chromium/issues/detail?id=512627#c158
for %%i in ("gupdate" "gupdatem") do (
  "%windir%\system32\net.exe" stop %%~i>nul 2>&1
  "%windir%\system32\sc.exe" config %%~i start= demand>nul
  if errorlevel 1 pause
)

echo Stopping and disabling Google Update tasks . . .
rem | avoid overhead and help preventing the services configuration from being reset
for %%i in ("GoogleUpdateTaskMachineCore" "GoogleUpdateTaskMachineUA") do (
  "%windir%\system32\schtasks.exe" /end /TN "\%%~i">nul 2>&1
  "%windir%\system32\schtasks.exe" /change /disable /TN "\%%~i">nul
  if errorlevel 1 pause
)

echo Updating Google Update policy . . .
set TARGET_KEY=HKLM\SOFTWARE\Policies\Google\Update
for %%i in ("Update" "Install") do (
  rem | GUIDs mean "Google Chrome" and "Google Chrome binaries", which must be consistent
  rem | https://support.google.com/chrome/a/answer/3204698#auto-updates
  rem | Tip: to affect other Google Update packages, add "Default" to the list
  for %%j in ("{8A69D345-D564-463C-AFF1-A69D9E530F96}" "{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}") do (
    "%windir%\system32\reg.exe" add "%TARGET_KEY%" /v "%%~i%%~j" /t REG_DWORD /d 0 /f>nul
    if errorlevel 1 pause  
  )
)
rem | for machines *not* in a domain, this is limited to 77 hours (even when set to 0!)
rem | https://www.chromium.org/administrators/turning-off-auto-updates
"%windir%\system32\reg.exe" add "%TARGET_KEY%" /v "AutoUpdateCheckPeriodMinutes" /t REG_DWORD /d 0 /f>nul
if errorlevel 1 pause
rem | disable the auto-updater
rem | http://googlesystem.blogspot.pt/2009/05/customize-or-disable-google-update.html
"%windir%\system32\reg.exe" add "%TARGET_KEY%" /v "DisableAutoUpdateChecksCheckboxValue" /t REG_DWORD /d 1 /f>nul
if errorlevel 1 pause

echo Done!
rem | ~3s delay (backwards-compatible with Windows XP)
"%windir%\system32\ping.exe" -n 4 127.0.0.1>nul 2>&1

Save the text-area contents to a windows command script file (for example, GoogleChrome-DisableUpdates[RunAsAdministrator].cmd) and run as Administrator.

Tip: (partially stated in script comment above) to affect other Google Update packages, in step Updating Google Update policy add Default to the list, as in:

for %%j in ("{8A69D345-D564-463C-AFF1-A69D9E530F96}" "{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}" "Default") do (

That will cause updates policy to apply not only to Google Chrome but to all products supported by Google Update, provided that other product-specific keys (Update{GUID} and Install{GUID}) are not overriding these settings (source).

Related Question