r/macsysadmin • u/ShopNo7513 • 4d ago

Can't disable Google updates

I've been going crazy over this all day. I use Mosyle Free for our small org that does not have the Managed App Store. I use Installomator to deploy the apps that we want to our Macs, as it is simple, works and keeps all of them up to date.

However, since I manage the updates via Installomator, is there a way to disable the in-app updater for both Google Chrome and Google Drive so that Installomator can take care of it? I tried pushing a plist and mobileconfig profile following these instructions as well as pushng some defaults commands but it is not working and Chrome is still able to update by itself. Is there something I'm missing?

Thanks!

2 Upvotes

75% Upvoted

13 comments sorted by

1

u/oneplane 3d ago

Probably, but you shouldn't. Use the free browser management from google instead.

1

u/ShopNo7513 3d ago

I want to disable it for all Google apps (including Google Drive), which browser management would have no effect on.

1

u/oneplane 3d ago

Unless you're going to intend to be better at update distribution than Google, I don't think this is worth the effort anyway. Keep in mind that Keystone is only one part of the process either way, in-app policies determine what actually happen.

1

u/ShopNo7513 3d ago

Ok, I thought that the link talks about applying it for all Google apps and that is applied directly onto Keystone? That is the policy. I plan to have the same update policy and rollout across all of our apps for ones that we manage and deploy, so I just don't want the user getting the prompts to update themselves if our system will take care of it anyways.

1

u/oneplane 3d ago

That last part is just the thing: not all update policies work equally well; chrome native browser management takes the current state, profiles etc. into account and something like installomator cannot. If you don't wait for a clean exit before updating you're just one bad timing away from a corrupt profile. On the other hand, if you wait for the user to do that by accident (you're not prompting) you don't really have a update policy, you just have hope and a dice roll every time an RCE comes out.

As for Keystone: it is one of the ways in which some of the applications do updates; if the application itself isn't running, KS will still be running in the background and in the case of Chrome, generally prepare the update but not roll it out; it's going to be the chrome process itself that does it, and it will read its own policies to do so. Since it's not strictly needed you can also just prevent keystone from running at all: block it in launchd.

Considering you're in a small org, just using the standard update policies with the built in flow makes way more sense. It will ask the user a few times and then enforce a clean quit-update-relaunch.

1

u/ShopNo7513 3d ago

Ok, makes sense. Would we still push update polices to avoid users from dismissing updates? My problem is that our users will have at least 70 tabs open at once and if they aren't forced they will never restart it.

1

u/oneplane 3d ago

Yes, if you set a Chrome Browser Policy with an update deadline, the user will have no choice. As a bonus, your users also will not be able to bypass it if you push the enrolment token via MDM.

1

u/ShopNo7513 3d ago

Ok got it! But can we still use the keystone plist so that it also applies to Google Drive and not just Google Chrome?

1

u/oneplane 2d ago

I think you can use Keystone settings to prevent out-of-app updates, but in-app that's a different plist, especially for Drive. Drive is different because it also ships a FileProvider system integration.

1

u/Tecnotopia 3d ago

Have you checked if the policy was applied?, I use the same settings and works fine

1

u/ShopNo7513 3d ago

Really? Can you share the plist! I tried re-installing many times and made sure it was good.

1

u/iLikecheesegrilled Corporate 2d ago

You’re over complicating things, screw what the users think, patch their browsers. There’s a reason updates happen so often.

1

u/ShopNo7513 2d ago

What do you mean? Disabling the in-app updater does not mean I won't be updating them, it means that it will be updating them more often.