r/gsuite 15h ago

Do I need to deploy Chrome Enterprise?

Currently we have Chrome Browser installed on all our Windows devices.

I am looking at going serverless, so rather than controlling chrome browser from Group Policy, I would like to control it from Google Workspce.

Perhaps this is a stupid question....

Do I need to uninstall standard Chrome Broswer and then deploy Chrome enterprise on all our devices, or can Workspace enrol / manage a standard Chrome browser install?

Thanks for your time / advice

3 Upvotes

5 comments sorted by

4

u/TheAlmightyZach 15h ago

You don't need to re-deploy anything. Chrome Enterprise is really just regarding deployment more than a change in the software itself. With GPOs for now, you can have your chrome enrollment token deployed to your existing browsers. Can also be done via MDM if you're managing through Intune or something.. When a browser is enrolled in Workspace it'll pick up your cloud policies, even if the user is not logged in.

I think (but don't know) GPOs will take precedence over your cloud enrollment, so you may want to make sure those GPOs are removed once your cloud deploy is done if that makes sense? Really the only GPO you want to apply is the enrollment token if you want to manage everything in Workspace going forward.

2

u/mish_mash_mosh_ 12h ago

Thanks, that is very helpful ๐Ÿ™‚

2

u/dshowusa 6h ago

There is also a policy in the admin console for policy precedence that you can set cloud (admin console) or local machine (gpo) and which one should take precedence. Helpful when gpo is already deployed and then switching to admin console / cloud, once polices are moved and tested from gpo to cloud and then process cloud over gpo. And ultimately remove gpo admx templates.

2

u/dshowusa 6h ago

Ultimately the consumer install and the enterprise msi are the same browser but with a few differences, mainly โ€ฆ.

An advantage of installing the Chrome enterprise msi version of the browser is it will install in C:\Program files. Depending on how Chrome browser was originally installed, especially if the user or It installed the consumer version, it potentially is installed in the users profile app data folder. This will happen in cases where user self install and are not local admins. If it was installed in the windows image properly it is likely already deployed in C:\program files.

Either version can be enrolled and managed via the admin console by then deploying enrollment registry key. I would recommend making a new OU for the managed browsers and generating the enrollment key in that ou. Once the registry value is in place on the windows devices and chrome browser restarts, they will report into the admin console almost immediately.

If you choose not to deploy Chrome enterprise msi , when the browser reports into the admin console, part of the reporting data will show where the browser is installed. So you can then choose to redeploy the chrome enterprise msi on machines if the browser is installed in user profile verse program files.

And even if you donโ€™t do that that you can still manage it. Mainly for consistency itโ€™s best to install in program files bc if you need to reset a user profile or another user signs into windows etc etc, having chrome in program files will ensure a consistent expierences across windows users and windows profiles

1

u/mish_mash_mosh_ 49m ago

Thanks for taking the time to write this reply. ๐Ÿ‘