How do I disable Google Chrome silent updates?

Question

I've done the instructions that I found online and Chrome is still automatically updating itself.

I've downloaded and installed the ADM template so I can use Local Policy to disable updates. I've set it to manual updates only. I've also added keys to the registry at HKLM/SOFTWARE/Policies/Google/Update

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update]
"UpdateDefault"=dword:00000000
"AutoUpdateCheckPeriodMinutes"=dword:00000000
"DisableAutoUpdateChecksCheckboxValue"=dword:00000000
"Update{8A69D345-D564-463C-AFF1-A69D9E530F96}"=dword:00000000
"Install{8A69D345-D564-463C-AFF1-A69D9E530F96}"=dword:00000000

Google Update Services are both disabled. (gupdate and gupdatem)

Answer 1

Google Update Services are both disabled. (gupdate and gupdatem)

This is likely the guilty, as it seems to cause the policy settings to be ignored (source). So you shouldn't disable the services (set both to Manual instead).

Second, a few comments regarding the proposed registry settings:

• UpdateDefault can be set to 3 in order to prevent updates for all Google software (source)
• AutoUpdateCheckPeriodMinutes is not interpreted the same when machines are not in a domain (source)
• Update{8A69D345-D564-463C-AFF1-A69D9E530F96} is a Chrome-specific override for UpdateDefault. Either set to 3 or remove if UpdateDefault is present and set to 3 (i.e., inherit the default)
• Install{8A69D345-D564-463C-AFF1-A69D9E530F96} is a Chrome-specific override for InstallDefault. Either set to 0 or remove if InstallDefault is specified and set to 0 (i.e., inherit the default)
• Chrome Binaries policy also needs to exist and the "two need to match in order for auto-update policies to work correctly" (source)

Based in the above, a script was created (which also updates services and scheduled tasks):

@echo off

rem | References:
rem | https://support.google.com/chrome/a/answer/6350036#Registry_Settings
rem | http://stackoverflow.com/a/28356336/1111895
rem | http://superuser.com/questions/645845/how-do-i-disable-google-chrome-silent-updates

echo Stopping and setting Google Update services to manual . . .
rem | don't disable the services as it seems to cause the policy settings to be ignored
rem | https://bugs.chromium.org/p/chromium/issues/detail?id=512627#c158
for %%i in ("gupdate" "gupdatem") do (
  "%windir%\system32\net.exe" stop %%~i>nul 2>&1
  "%windir%\system32\sc.exe" config %%~i start= demand>nul
  if errorlevel 1 pause
)

echo Stopping and disabling Google Update tasks . . .
rem | avoid overhead and help preventing the services configuration from being reset
for %%i in ("GoogleUpdateTaskMachineCore" "GoogleUpdateTaskMachineUA") do (
  "%windir%\system32\schtasks.exe" /end /TN "\%%~i">nul 2>&1
  "%windir%\system32\schtasks.exe" /change /disable /TN "\%%~i">nul
  if errorlevel 1 pause
)

echo Updating Google Update policy . . .
set TARGET_KEY=HKLM\SOFTWARE\Policies\Google\Update
for %%i in ("Update" "Install") do (
  rem | GUIDs mean "Google Chrome" and "Google Chrome binaries", which must be consistent
  rem | https://support.google.com/chrome/a/answer/3204698#auto-updates
  rem | Tip: to affect other Google Update packages, add "Default" to the list
  for %%j in ("{8A69D345-D564-463C-AFF1-A69D9E530F96}" "{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}") do (
    "%windir%\system32\reg.exe" add "%TARGET_KEY%" /v "%%~i%%~j" /t REG_DWORD /d 0 /f>nul
    if errorlevel 1 pause  
  )
)
rem | for machines *not* in a domain, this is limited to 77 hours (even when set to 0!)
rem | https://www.chromium.org/administrators/turning-off-auto-updates
"%windir%\system32\reg.exe" add "%TARGET_KEY%" /v "AutoUpdateCheckPeriodMinutes" /t REG_DWORD /d 0 /f>nul
if errorlevel 1 pause
rem | disable the auto-updater
rem | http://googlesystem.blogspot.pt/2009/05/customize-or-disable-google-update.html
"%windir%\system32\reg.exe" add "%TARGET_KEY%" /v "DisableAutoUpdateChecksCheckboxValue" /t REG_DWORD /d 1 /f>nul
if errorlevel 1 pause

echo Done!
rem | ~3s delay (backwards-compatible with Windows XP)
"%windir%\system32\ping.exe" -n 4 127.0.0.1>nul 2>&1

Save the text-area contents to a windows command script file (for example, GoogleChrome-DisableUpdates[RunAsAdministrator].cmd) and run as Administrator.

Tip: (partially stated in script comment above) to affect other Google Update packages, in step Updating Google Update policy add Default to the list, as in:

for %%j in ("{8A69D345-D564-463C-AFF1-A69D9E530F96}" "{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}" "Default") do (

That will cause updates policy to apply not only to Google Chrome but to all products supported by Google Update, provided that other product-specific keys (Update{GUID} and Install{GUID}) are not overriding these settings (source).

Answer 2

I don't agree fully with the answer by Helder Magalhães. Let me recall the main points.

1. The Update Controls have been released on Thursday, May 14, 2009 (blog post), and things changed a bit since.
2. The simplest way to configure Google Updates is outlined at this page. It involves downloading and setting up specific group policy templates.
3. The policies are meant to be used in an Active Directory domain context. Specifically, this Chromium Project page states clearly that:

Warning: To prevent abuse of this policy, if a device is not joined to an Active Directory domain, and if this policy has been set to 0 or to a value greater than 77 hours, this setting will not be honored and replaced by 77 hours after August 2014. If you are affected by this, and still want to disable Chrome updates (NOT RECOMMENDED), you may do so by using 'Update policy override' as described here.

This Warning refers to a specific advice:

Set the value of HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update\AutoUpdateCheckPeriodMinutes to the REG_DWORD value of "0".

and the page linked at the end of the Warning is again the one I reported at point 2.

4. Group policies may be used locally as well (this is not really straightforward, since the corresponding snap-ins are not added by default to the mmc on Win - anyway, I'm not going to detail this here). However, one finds quickly that they are not honored if the machine is not joined to an Active Directory domain. This without messing up with services or scheduled tasks, so the guilty is not with the Google Update Services. Indeed, seems that the info at the Chromium Project page (see link at point 3.) is not really up to date, and if the device is not on a domain the Update policy override is not honored as well. The thing is discussed at this bug report, and, although not really openly stated, my last assertion seems to be confirmed by posts 38, 62, 70 and 127. Even more, I activated the log file for Google Update (see procedure outlined at the link at point 3., under Troubleshoot -> Step 1: Create a log file), and found lots of lines ending with the remark [Ignoring group policy][machine is not part of a domain].
5. Besides group policies for Google Updates, there are also policies for Chrome (see here), but also these do not help in any way. One may try to manage Chrome policies with Windows registry or to use master preferences for Chrome Browser, which however fails again (at least it failed in my non-exaustive tests).

To sum up, in order for Google Update to accept any configuration the machine must be joined to an Active Directory domain. Well, to the knowledge of Google Update...

And there comes the trick. Google Update is based on the Omaha Project, whose source code is available at GitHub. Registry keys and values are defined in this file; to our aim, the relevant value is found at line 323 (please read the comments just above).

I'd prefer not to write explicitly what to do at this point, for a couple of reasons (not making life too easy for malware, and trying not to have the folks at Google eliminating even this last customization choice). If anyone can't figure out the reg key, please see here.

After tweaking the registry, local group policies are applied independent of whether the computer is joined to a domain or not. And the Update policy override is sufficient to disable Chrome updates, as appears clearly at chrome://chrome (didn't check the "only manual" setting yet, since it doesn't show up at chrome://chrome, so I have to wait for the next available update). No need to tweak Chrome-specific policies, nor the Chrome Binaries policy it seems.

Last note: deleting the folder C:\Program Files (x86)\Google\Update does not disable updates, it breaks the whole Google Update mechanism. And one needs to disable updating for Chrome components as well, otherwise sooner or later Google Update gets restored (see this question and this file, in particular the comment at lines 17-18).

Answer 3

delete the next folder: c:\program files(x86)\google\update\