Configuration Profile- Allow Apps/Disallow Apps with ksadmin/GoogleUpdater error

[EMCSD-IT]

There has been loads of discussions about this issue, but I would like to not go down the avenue of deleting files in Google to get this to work correctly. Here is the issue:

When I allow and disallow apps to run to keep students from running apps and programs in folders such as Desktop, Documents, etc, I receive errors on the Google side, especially the ksadmin and GoogleUpdater error. Often times, Google Chrome itself will crash.

I have gone through about every discussion to try to get to the ~/Library folder with little luck. Attached is what I have so far...

If you have had luck with this and could attach what your pathways are using, that would be helpful to see what others are using. Also, is everyone using a Computer-Level deployment or a User-Level deployment? Both methods have no luck on my end
.

[martin]

Use a Custom Settings Configuration Profile:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>updatePolicies</key>
    <dict>
        <key>global</key>
        <dict>
            <key>UpdateDefault</key>
            <integer>3</integer>
        </dict>
        <key>com.google.Chrome</key>
        <dict>
            <key>UpdateDefault</key>
            <integer>3</integer>
        </dict>
    </dict>
</dict>
</plist>

Manage Chrome updates (Mac): https://support.google.com/chrome/a/answer/7591084

[CasperSally]

@martin are you using this with a profile to also restrict apps from launching from /Users context? My testing is the profile Google suggests will stop the ksadmin prompts, but not the GoogleSoftwareUpdate prompt.

For anyone who finds this, consider starring this if you'd like to see Chrome stop launching app out of /Users): https://bugs.chromium.org/p/chromium/issues/detail?id=889150

[martin]

@CasperSally, I have seen different results after my post. Google makes it hard to just disable (or enable) automatic updates. Eventually I used a script (it's here on Jamf Nation) to delete Google Software Update and create a empty folder which doesn't allow Google Software Update to install it.

[CasperSally]

@martin Yea, I hate ongoing scripts and the way our labs are set up, I'll have to go that direction probably via outset. It's a shame since chrome updates are easily disabled on windows/chromeOS. Please consider starring the crbug if you'd like to see them improve this.

[martin]

@CasperSally I agree. Would be nice if Google supports Configuration Profiles to disable updates.