How can I prevent the installation of Chrome extensions on desktop?
You can do this with a GPO. Go to Computer Configuration > Administrative Templates > Google > Google Chrome. Look for a folder named Allowed extensions. There configure a blacklist of
*. This will prevent users from installing plugins.
you can make it local by giving permission on extention folder in this path
C:\Users\*your user*\AppData\Local\Google\Chrome\User Data\Default\Extensions
rightclick->security-> select user-> deny all
I was going to add this as a comment to Lucas Kauffman's answer, but I don't have the rep to leave comments yet.
In Win7 Ultimate (and probably most other versions of Win7), you have to download and install Google's GPO manually before you have access to the GPO settings Lucas Kauffman mentioned.
DL and unzip google's Administrative templates, Then add the GPO template for Google Chrome manually: Right-click Administrative Templates and select Add/Remove Templates then browse to where you Downloaded and Extracted the policies and add the one for your region, then follow Lucas Kauffman's instructions:
"Go to Computer Configuration > Administrative Templates > Google > Google Chrome. Look for a folder named Allowed extensions. There configure a blacklist of *. This will prevent users from installing plugins." - Lucas Kauffman
- I haven’t had success with filesystem permissions
- I could write a cron script to delete the folder every minute, but that felt too brute-force
I've seen the reference to use a group policy. I'm not familiar with that and didn't find the instructions clear to follow, so I've settled for configuring a Folder Action Script to just delete the extension's folder whenever it's created:
Open Script Editor
Create a script with the following:
on adding folder items to this_folder after receiving added_items
tell application "Finder"
repeat with added_item in added_items
if name of added_item is "<place the extension's id here>" then delete added_item
end adding folder items to
Save it to
~/Library/Scripts/Folder Action Scripts/or
/Library/Scripts/Folder Action Scripts/
Choose Configure Folder Actions to add the created script to the folder
In my experience, this is enough. The folder is not deleted immediately, but with a delay of few seconds. Chrome's attempts to restore the folder each time you start it aren't successful. You can hear Finder's 'file deleted' sound.
For Mac, open terminal as the user and type:
chmod 444 ~/Library/Application Support/Google/Chrome/Default/Extensions
If you don't use extensions change the name of the extension folder. ex: C:\Users\Username\AppData\Local\Google\Chrome\User Data\Default\Extensions
change it to 0000extensions or what ever.
seems to fix the problem, if you do not use extensions. Extensions can not be downloaded when the folder does not exist.