How can I prevent the installation of Chrome extensions on desktop?


6 Answers 6


You can do this with a GPO. Go to Computer Configuration > Administrative Templates > Google > Google Chrome. Look for a folder named Allowed extensions. There configure a blacklist of *. This will prevent users from installing plugins.


I was going to add this as a comment to Lucas Kauffman's answer, but I don't have the rep to leave comments yet.

In Win7 Ultimate (and probably most other versions of Win7), you have to download and install Google's GPO manually before you have access to the GPO settings Lucas Kauffman mentioned.

DL: http://dl.google.com/dl/edgedl/chrome/policy/policy_templates.zip

DL and unzip google's Administrative templates, Then add the GPO template for Google Chrome manually: Right-click Administrative Templates and select Add/Remove Templates then browse to where you Downloaded and Extracted the policies and add the one for your region, then follow Lucas Kauffman's instructions:

"Go to Computer Configuration > Administrative Templates > Google > Google Chrome. Look for a folder named Allowed extensions. There configure a blacklist of *. This will prevent users from installing plugins." - Lucas Kauffman


you can make it local by giving permission on extention folder in this path

C:\Users\*your user*\AppData\Local\Google\Chrome\User Data\Default\Extensions

rightclick->security-> select user-> deny all

  • This was my go to solution ever since. Until on Chrome 72, after applying Chrome marks the extensions unusable, corrupted and needs repair. Do not deny all. Just deny write for user.
    – admin
    Mar 3, 2019 at 0:33
  • Unfortunately, this can be easily bypassed by creating a new profile in Chrome. Each new profile gets its own folder C:\Users*your user*\AppData\Local\Google\Chrome\User Data\<profile>\Extensions
    – DFB
    Oct 10, 2021 at 14:44

On Mac,

  • I haven’t had success with filesystem permissions
  • I could write a cron script to delete the folder every minute, but that felt too brute-force

I've seen the reference to use a group policy. I'm not familiar with that and didn't find the instructions clear to follow, so I've settled for configuring a Folder Action Script to just delete the extension's folder whenever it's created:

  • Open Script Editor

  • Create a script with the following:

on adding folder items to this_folder after receiving added_items tell application "Finder" repeat with added_item in added_items if name of added_item is "<place the extension's id here>" then delete added_item end repeat end tell end adding folder items to

  • Save it to ~/Library/Scripts/Folder Action Scripts/ or /Library/Scripts/Folder Action Scripts/

  • Right-click ~/Library/Application Support/Google/Chrome/Default/Extensions

  • Choose Configure Folder Actions to add the created script to the folder

In my experience, this is enough. The folder is not deleted immediately, but with a delay of few seconds. Chrome's attempts to restore the folder each time you start it aren't successful. You can hear Finder's 'file deleted' sound.

  • Why would it be targeted to a particular extension's ID, if the goal is to counter the addition of any new extension?
    – Jacob C.
    Apr 5, 2018 at 17:14
  • because 1) the question didn't make it explicit that it referred to any/all, and 2) this can easily be adapted to target any extensions, whereas the reverse would not be so simple to adapt for those not familiar with AppleScript.
    – entonio
    Apr 5, 2018 at 17:20
  • 1
    Ah. Fair enough. The Windows-related answers seem to interpret the question as having meant "any" (which is my guess at the indended meaning as well, and what I myself came here looking for, after having found that a relative had mistakenly installed sketchy extensions), but in any case, as you say, this is easily adapted by removing if name of added_item is "<place the extension's id here>" then . Thank you.
    – Jacob C.
    Apr 9, 2018 at 20:28

For Mac, open terminal as the user and type:

chmod 444 ~/Library/Application\ Support/Google/Chrome/Default/Extensions

This changes the permissions on the Extensions folder to read only and stops new extensions from being installed.

  • 2
    Can you expand on your answer to explain what the command does and how it answers the question?
    – schroeder
    Aug 26, 2018 at 19:49
  • This command stops extensions from being updated, too...
    – schroeder
    Dec 13, 2019 at 7:39
  • This was exactly what I wanted. My grandmother keeps getting keyloggers and random crap installed through scammers and I needed something as harsh as this to lock it down. Thank you! Aug 4, 2021 at 15:14
  • This command stopped my extensions from working at all. There may be a variation on the chmod command that would work better, but you may be onto a good solution here. My worry about this answer is that my Extensions directory did not have read permissions for Group and Other which this command grants. I could imagine that might expose sensitive data if any extension files house it.
    – King Holly
    Jan 18, 2022 at 21:00

If you don't use extensions change the name of the extension folder. ex: C:\Users\Username\AppData\Local\Google\Chrome\User Data\Default\Extensions

change it to 0000extensions or what ever.

seems to fix the problem, if you do not use extensions. Extensions can not be downloaded when the folder does not exist.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .