Chrome Enterprise Deployment Guide

Introduction

Deploying Chrome across an enterprise can be a complex task, involving the configuration and management of numerous devices. This guide covers Chrome enterprise deployment with MSI and PKG packages, Group Policy, SCCM and Intune rollout, silent installation, update management, and rollback.

MSI and PKG Deployment

MSI and PKG files are the installers for deploying Chrome on Windows and macOS. Both are on the Chrome Enterprise download page.

Windows: Using MSI with Group Policy

1. Download the MSI package and put it on a network share your computers can read.
2. Open the Group Policy Management Console (Win + R, then type gpmc.msc).
3. Edit a GPO and go to Computer Configuration > Policies > Software Settings > Software Installation.
4. Right-click and select New > Package, then select the MSI file by its network path.
5. Choose Assigned and click OK.

macOS: Using PKG

1. Download the PKG installer (GoogleChrome.pkg) from the same page.
2. Use Apple Remote Desktop, your mobile device management (MDM) tool or another deployment tool to distribute the PKG file.
3. Ensure the package is installed on each target machine.
4. Verify installation by checking that Google Chrome is in the Applications folder. Policies are deployed separately as a configuration profile, as Google’s Mac quick start describes.

SCCM and Intune Rollout

Deploy Chrome to your organization using SCCM or Intune.

Deploying with SCCM

1. Open the SCCM Console and go to Software Library > Overview > Application Management > Applications.
2. Create a new application and select the MSI installer.
3. Define deployment types and set appropriate user experience settings.
4. Deploy the application to a device collection.

Deploying with Intune

1. Sign in to the Microsoft Intune admin center.
2. Select Apps > All Apps > Create.
3. For the MSI, select the Windows platform and then Line-of-business app, as in Microsoft’s guide. Microsoft notes that mixing Win32 and line-of-business apps during Windows Autopilot enrollment can make installs fail.
4. Upload the application package and configure deployment settings.
5. Assign the app to groups and review the deployment status.

Silent Installation Parameters

For a seamless user experience, use silent installation parameters:

• Windows: Use the command line msiexec /i googlechromestandaloneenterprise64.msi /qn from an elevated prompt.
• macOS: Use the command sudo installer -pkg GoogleChrome.pkg -target /.

Update Management Strategies

Keep Chrome updated with these strategies. Google recommends leaving auto-updates on so users get security fixes.

Using Group Policy

Update settings come from the separate Google Update template, not the Chrome template. Following Google’s Manage Chrome updates (Windows):

1. Copy google.admx and GoogleUpdate.admx (and their .adml files) into C:\Windows\PolicyDefinitions.
2. In Group Policy, under Computer Configuration, go to Google > Google Update > Applications > Google Chrome.
3. Enable Update policy override and, under Options, choose Allow updates (recommended).

Via the Google Admin Console

If your browsers are enrolled in Chrome Enterprise Core, you can also set browser policies and manage extensions from the Google Admin console.

Rollback Procedures

If an update causes issues, Google provides two ways to go back on Windows:

1. Recent versions: In Google > Google Update > Applications > Google Chrome, enable Rollback to Target version and Target version prefix override. This works for the 3 latest major releases. Running older versions exposes users to known security issues.
2. Older versions: Google’s Downgrade your Chrome version help uses msiexec with ALLOWDOWNGRADE=1. Google warns that downgrading this way deletes user profiles and cache data, so only do it if necessary and try it on a small test group first.