Hardening and customizing Google Chrome via policy (registry)

Quick one here. Just going to list some policies, discuss setting them, and link to the docs and a script for setting them.

We can manage Chrome via MDM (like Intune), Group Policy (if the machine is joined to an Active Directory domain and you’ve imported the relevant ADMX), via ‘preferences’ JSON config files (Mac or Linux), or via the Windows registry (my preferred option since it applies to any Windows PC, regardless of management infrastructure, and is easy to script).

For some policies to get you started, take a look at the Security Configuration Guide.

These recommendations boil down to:

I’ll add a recommendation to deploy a good adblocker, like uBlock Origin Lite. The CISA recommends this, too - you should really be deploying one. I have a script for this, too, with some usage examples - find it on GitHub. You can likely adapt this for your scenario, or take a variable for ExtensionId with a small bit of effort.

We’ll be making some tweaks to telemetry and generative AI features, too.

An aside about the DNS client option - keeping the Chrome DNS client enabled allows some security features (like Encrypted Hello, which improves privacy by making it more difficult for someone with control of the network to inspect your traffic) and HTTPS Resource Records.

This DNS client does NOT send requests to Google; it just has some additional features.

If your DNS stack is incompatible with the Chrome DNS client, it may be reasonable to force Chrome to use the system resolver. Otherwise, you should use Chrome’s resolver.

If you do not supply your users a password manager, it’s probably not a good idea to disable the Chrome password manager.

If you do provide one, you can disable the built-in Chrome password manager with the PasswordManagerEnabled policy (set PasswordManagerEnabled 0).

This prevents annoying double prompts to save your password and can help control where your users’ passwords go.

Setting policies

To set a policy with PowerShell, all that’s needed is to set a registry property under either the recommended or enforced key (HKLM:\SOFTWARE\Vendor\Product or Vendor\Product\Recommended, like HKLM:\SOFTWARE\Google\Chrome\Recommended).

Here is an example of a wrapper function to do this:

function Set-Policy {
  param (
    [Parameter(Mandatory)]
    [string]$PolicyPath
    ,
    [Parameter(Mandatory)]
    [string]$PropertyName
    ,
    [Parameter(Mandatory)]
    $DesiredValue
    ,
    [Parameter(Mandatory)]
    [string]$Description
  )

  # get properties of the policy key
  $PolicyProperties = (Get-ItemProperty $PolicyPath)

  # if the property's value is not already set to the desired value, set it.
  $CurrentValue = $PolicyProperties.$PropertyName

  if ($CurrentValue -eq $DesiredValue) {

    Write-Host "Policy '$($PropertyName)' is already set to '$($DesiredValue)'. No changes will be made."

  } else {

    Write-Host "Setting policy '$($PropertyName)' to '$($DesiredValue)' ($($Description))"

    Set-ItemProperty `
      -Path $PolicyPath `
      -Name $PropertyName `
      -Value $DesiredValue

  }

}

This is fairly trivial, so I won’t be going into it very much. This function works for Edge or Chrome policies. For an example of usage, please see my ‘BrowserPowerShell’ GitHub repository. This contains all the tweaks listed below.

Policies to set

So now that we know how to set a policy, what do we want to set?

Disable nags and ‘private’ profiling

Chrome does very well with the nags at startup (at least, it does very well here compared to Edge).

However, there’s some telemetry going on, and a startup prompt about it. To disable the nag at first startup and force Google’s special, Chrome-specific ‘private’ advertisement telemetry and profiling off, set:

Configuring Safe Browsing

In a business environment, you probably do want Safe Browsing enabled and enforced.

Password Protection

Chrome Password Protection will capture salted hashes of passwords so it can tell if a password has been reused somewhere. If you’d like to configure this, the following policies are relevant:

Enforcing secure defaults

Some good defaults to enforce are:

Extra tweaks

That’s all for today. As mentioned a bit above, for examples of usage and some extra policies for Edge, consider having a look at my ‘BrowserPowerShell’ Git repo, which contains a setter and a selection of policies and values to start from. In the future, Gecko (Firefox) policy will go here, too.