Accessibility settings

ShowAccessibilityOptionsInSystemTrayMenu

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ShowAccessibilityOptionsInSystemTrayMenu

Supported on:

• Google Chrome OS (Google Chrome OS) since version 27

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

If this policy is set to true, Accessibility options always appear in system tray menu.

If this policy is set to false, Accessibility options never appear in system tray menu.

If you set this policy, users cannot change or override it.

If this policy is left unset, Accessibility options will not appear in the system tray menu, but the user can cause the Accessibility options to appear via the Settings page.

When accessiblity features are enabled by other means (e.g by a key combination), Accessibility options will always appear in system tray menu.

Example value:

0x00000001 (Windows)

LargeCursorEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\LargeCursorEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enable the large cursor accessibility feature.

If this policy is set to true, the large cursor will always be enabled.

If this policy is set to false, the large cursor will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the large cursor is disabled initially but can be enabled by the user anytime.

Example value:

0x00000001 (Windows)

SpokenFeedbackEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\SpokenFeedbackEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enable the spoken feedback accessibility feature.

If this policy is set to true, spoken feedback will always be enabled.

If this policy is set to false, spoken feedback will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, spoken feedback is disabled initially but can be enabled by the user anytime.

Example value:

0x00000001 (Windows)

HighContrastEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\HighContrastEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enable the high contrast mode accessibility feature.

If this policy is set to true, high contrast mode will always be enabled.

If this policy is set to false, high contrast mode will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, high contrast mode is disabled initially but can be enabled by the user anytime.

Example value:

0x00000001 (Windows)

VirtualKeyboardEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\VirtualKeyboardEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 34

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enable the on-screen keyboard accessibility feature.

If this policy is set to true, the on-screen keyboard will always be enabled.

If this policy is set to false, the on-screen keyboard will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the on-screen keyboard is disabled initially but can be enabled by the user anytime.

Example value:

0x00000001 (Windows)

StickyKeysEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\StickyKeysEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 76

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enable the sticky keys accessibility feature.

If this policy is set to true, the sticky keys will always be enabled.

If this policy is set to false, the sticky keys will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the sticky keys is disabled initially but can be enabled by the user anytime.

Example value:

0x00000001 (Windows)

KeyboardDefaultToFunctionKeys

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\KeyboardDefaultToFunctionKeys

Supported on:

• Google Chrome OS (Google Chrome OS) since version 35

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Changes the default behaviour of the top row keys to function keys.

If this policy is set to true, the keyboard's top row of keys will produce function key commands per default. The search key has to be pressed to revert their behavior back to media keys.

If this policy is set to false or left unset, the keyboard will produce media key commands per default and function key commands when the search key is held.

Example value:

0x00000001 (Windows)

ScreenMagnifierType

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ScreenMagnifierType

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

If this policy is set, it controls the type of screen magnifier that is enabled. Setting the policy to "None" disables the screen magnifier.

If you set this policy, users cannot change or override it.

If this policy is left unset, the screen magnifier is disabled initially but can be enabled by the user anytime.

• 0 = Screen magnifier disabled
• 1 = Full-screen magnifier enabled
• 2 = Docked magnifier enabled

Example value:

0x00000001 (Windows)

DeviceLoginScreenDefaultLargeCursorEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceLoginScreenDefaultLargeCursorEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Dynamic Policy Refresh: Yes

Description:

Set the default state of the large cursor accessibility feature on the login screen.

If this policy is set to true, the large cursor will be enabled when the login screen is shown.

If this policy is set to false, the large cursor will be disabled when the login screen is shown.

If you set this policy, users can temporarily override it by enabling or disabling the large cursor. However, the user's choice is not persistent and the default is restored whenever the login screen is shown anew or the user remains idle on the login screen for a minute.

If this policy is left unset, the large cursor is disabled when the login screen is first shown. Users can enable or disable the large cursor anytime and its status on the login screen is persisted between users.

Example value:

0x00000001 (Windows)

DeviceLoginScreenDefaultSpokenFeedbackEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceLoginScreenDefaultSpokenFeedbackEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Dynamic Policy Refresh: Yes

Description:

Set the default state of the spoken feedback accessibility feature on the login screen.

If this policy is set to true, spoken feedback will be enabled when the login screen is shown.

If this policy is set to false, spoken feedback will be disabled when the login screen is shown.

If you set this policy, users can temporarily override it by enabling or disabling spoken feedback. However, the user's choice is not persistent and the default is restored whenever the login screen is shown anew or the user remains idle on the login screen for a minute.

If this policy is left unset, spoken feedback is disabled when the login screen is first shown. Users can enable or disable spoken feedback anytime and its status on the login screen is persisted between users.

Example value:

0x00000001 (Windows)

DeviceLoginScreenDefaultHighContrastEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceLoginScreenDefaultHighContrastEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Dynamic Policy Refresh: Yes

Description:

Set the default state of the high contrast mode accessibility feature on the login screen.

If this policy is set to true, high contrast mode will be enabled when the login screen is shown.

If this policy is set to false, high contrast mode will be disabled when the login screen is shown.

If you set this policy, users can temporarily override it by enabling or disabling high contrast mode. However, the user's choice is not persistent and the default is restored whenever the login screen is shown anew or the user remains idle on the login screen for a minute.

If this policy is left unset, high contrast mode is disabled when the login screen is first shown. Users can enable or disable high contrast mode anytime and its status on the login screen is persisted between users.

Example value:

0x00000001 (Windows)

DeviceLoginScreenDefaultVirtualKeyboardEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceLoginScreenDefaultVirtualKeyboardEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 34

Supported features:

Dynamic Policy Refresh: Yes

Description:

Set the default state of the on-screen keyboard accessibility feature on the login screen.

If this policy is set to true, the on-screen keyboard will be enabled when the login screen is shown.

If this policy is set to false, the on-screen keyboard will be disabled when the login screen is shown.

If you set this policy, users can temporarily override it by enabling or disabling the on-screen keyboard. However, the user's choice is not persistent and the default is restored whenever the login screen is shown anew or the user remains idle on the login screen for a minute.

If this policy is left unset, the on-screen keyboard is disabled when the login screen is first shown. Users can enable or disable the on-screen keyboard anytime and its status on the login screen is persisted between users.

Example value:

0x00000001 (Windows)

DeviceLoginScreenDefaultScreenMagnifierType

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceLoginScreenDefaultScreenMagnifierType

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Dynamic Policy Refresh: Yes

Description:

Set the default type of screen magnifier that is enabled on the login screen.

If this policy is set, it controls the type of screen magnifier that is enabled when the login screen is shown. Setting the policy to "None" disables the screen magnifier.

If you set this policy, users can temporarily override it by enabling or disabling the screen magnifier. However, the user's choice is not persistent and the default is restored whenever the login screen is shown anew or the user remains idle on the login screen for a minute.

If this policy is left unset, the screen magnifier is disabled when the login screen is first shown. Users can enable or disable the screen magnifier anytime and its status on the login screen is persisted between users.

• 0 = Screen magnifier disabled
• 1 = Full-screen magnifier enabled
• 2 = Docked magnifier enabled

Example value:

0x00000001 (Windows)

Android settings

ArcEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ArcEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 50

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

When this policy is set to true, ARC will be enabled for the user (subject to additional policy settings checks - ARC will still be unavailable if either ephemeral mode or multiple sign-in is enabled in the current user session).

If this setting is disabled or not configured then enterprise users are unable to use ARC.

Example value:

0x00000000 (Windows)

UnaffiliatedArcAllowed

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\UnaffiliatedArcAllowed

Supported on:

• Google Chrome OS (Google Chrome OS) since version 64

Supported features:

Dynamic Policy Refresh: No

Description:

If the policy is set to false, unaffiliated users will not be allowed to use ARC.

If the policy is unset or set to true, all users are allowed to use ARC (unless ARC is disabled by other means).

Changes to the policy will only be applied while ARC is not running, e.g. while Chrome OS is starting.

Example value:

0x00000000 (Windows)

ArcPolicy

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ArcPolicy

Supported on:

• Google Chrome OS (Google Chrome OS) since version 50

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies a set of policies that will be handed over to the ARC runtime. The value must be valid JSON.

This policy can be used to configure which Android apps are automatically installed on the device.

To pin apps to the launcher, see PinnedLauncherApps.

Schema:

{ "properties": { "applications": { "items": { "properties": { "defaultPermissionPolicy": { "description": "Policy for granting permission requests to apps. PERMISSION_POLICY_UNSPECIFIED: Policy not specified. If no policy is specified for a permission at any level, then the `PROMPT` behavior is used by default. PROMPT: Prompt the user to grant a permission. GRANT: Automatically grant a permission. DENY: Automatically deny a permission.", "enum": [ "PERMISSION_POLICY_UNSPECIFIED", "PROMPT", "GRANT", "DENY" ], "type": "string" }, "installType": { "description": "Specifies how an app is installed. OPTIONAL: The app is not installed automatically, but the user can install it. This is the default if this policy is not specified. PRELOAD: The app is installed automatically, but the user can uninstall it. FORCE_INSTALLED: The app is installed automatically and the user cannot uninstall it. BLOCKED: The app is blocked and cannot be installed. If the app was installed under a previous policy it will be uninstalled.", "enum": [ "OPTIONAL", "PRELOAD", "FORCE_INSTALLED", "BLOCKED" ], "type": "string" }, "managedConfiguration": { "description": "App-specific JSON configuration object with a set of key-value pairs, e.g. '\"managedConfiguration\": { \"key1\": value1, \"key2\": value2 }'. The keys are defined in the app manifest.", "type": "object" }, "packageName": { "description": "Android app identifier, e.g. \"com.google.android.gm\" for Gmail", "type": "string" } }, "type": "object" }, "type": "array" } }, "type": "object" }

Example value:

"{"applications":[{"packageName":"com.google.android.gm","installType":"FORCE_INSTALLED","defaultPermissionPolicy":"PROMPT","managedConfiguration":{}},{"packageName":"com.google.android.apps.docs","installType":"PRELOAD","defaultPermissionPolicy":"PROMPT","managedConfiguration":{}}]}"

ArcAppInstallEventLoggingEnabled

Data type:

Boolean

Supported on:

• Google Chrome OS (Google Chrome OS) since version 67

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enables reporting of key events during Android app installation to Google. Events are captured only for apps whose installation was triggered via policy.

If the policy is set to true, events will be logged. If the policy is set to false or unset, events will not be logged.

ArcBackupRestoreServiceEnabled

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ArcBackupRestoreServiceEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 68

Supported features:

Dynamic Policy Refresh: No, Per Profile: No

Description:

This policy controls the initial state of Android backup and restore.

When this policy is not configured or set to BackupAndRestoreDisabled, Android backup and restore is initially disabled.

When this policy is set to BackupAndRestoreEnabled, Android backup and restore is initially enabled.

When this policy is set to BackupAndRestoreUnderUserControl, the user is asked to choose whether to use Android backup and restore. If the user enables backup and restore, Android app data is uploaded to Android backup servers and restored from them upon app re-installations for compatible apps.

Note that this policy controls the state of Android backup and restore during initial setup only. The user can open Android settings afterward and turn Android backup and restore on/off.

• 0 = Backup and restore disabled
• 1 = User decides whether to enable backup and restore
• 2 = Backup and restore enabled

Example value:

0x00000001 (Windows)

ArcGoogleLocationServicesEnabled

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ArcGoogleLocationServicesEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 68

Supported features:

Dynamic Policy Refresh: No, Per Profile: No

Description:

This policy controls the initial state of Google location services.

When this policy is not configured or set to GoogleLocationServicesDisabled, Google location services are initially disabled.

When this policy is set to GoogleLocationServicesEnabled, Google location services are initially enabled.

When this policy is set to GoogleLocationServicesUnderUserControl, the user is asked to choose whether to use Google location services. This will allow Android apps to use the services to query the device location, and also will enable submitting of anonymous location data to Google.

Note that this policy controls the state of Google location services during initial setup only. The user can open Android settings afterward and turn Google location services on/off.

Note that this policy is ignored and Google location services are always disabled when the DefaultGeolocationSetting policy is set to BlockGeolocation.

• 0 = Google location services disabled
• 1 = User decides whether to enable Google location services
• 2 = Google location services enabled

Example value:

0x00000001 (Windows)

ArcCertificatesSyncMode

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ArcCertificatesSyncMode

Supported on:

• Google Chrome OS (Google Chrome OS) since version 52

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

If set to SyncDisabled or not configured, Google Chrome OS certificates are not available for ARC-apps.

If set to CopyCaCerts, all ONC-installed CA certificates with Web TrustBit are available for ARC-apps.

• 0 = Disable usage of Google Chrome OS certificates to ARC-apps
• 1 = Enable Google Chrome OS CA certificates to ARC-apps

Example value:

0x00000000 (Windows)

AppRecommendationZeroStateEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\AppRecommendationZeroStateEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enable App Recommendation in Zero State of search box in launcher.

If this policy is set to true, App recommendations may appear in the zero state search.

If this policy is set to false, App recommendations will not appear in the zero state search.

If you set this policy, users cannot change or override it.

If this policy is left unset, the default is False for managed devices.

Example value:

0x00000001 (Windows)

Content settings

DefaultCookiesSetting

Data type:

Integer [Android:choice, Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultCookiesSetting

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultCookiesSetting

Mac/Linux preference name:

DefaultCookiesSetting

Android restriction name:

DefaultCookiesSetting

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 10
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set whether websites are allowed to set local data. Setting local data can be either allowed for all websites or denied for all websites.

If this policy is set to 'Keep cookies for the duration of the session' then cookies will be cleared when the session closes. Note that if Google Chrome is running in 'background mode', the session may not close when the last window is closed. Please see the 'BackgroundModeEnabled' policy for more information about configuring this behavior.

If this policy is left not set, 'AllowCookies' will be used and the user will be able to change it.

• 1 = Allow all sites to set local data
• 2 = Do not allow any site to set local data
• 4 = Keep cookies for the duration of the session

Example value:

0x00000001 (Windows), 1 (Linux), 1 (Android), 1 (Mac)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : CookiesSettings

DefaultImagesSetting

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultImagesSetting

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultImagesSetting

Mac/Linux preference name:

DefaultImagesSetting

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 10
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set whether websites are allowed to display images. Displaying images can be either allowed for all websites or denied for all websites.

If this policy is left not set, 'AllowImages' will be used and the user will be able to change it.

Note that previously this policy was erroneously enabled on Android, but this functionality has never been fully supported on Android.

• 1 = Allow all sites to show all images
• 2 = Do not allow any site to show images

Example value:

0x00000001 (Windows), 1 (Linux), 1 (Mac)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : ImageSettings

DefaultJavaScriptSetting

Data type:

Integer [Android:choice, Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultJavaScriptSetting

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultJavaScriptSetting

Mac/Linux preference name:

DefaultJavaScriptSetting

Android restriction name:

DefaultJavaScriptSetting

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 10
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set whether websites are allowed to run JavaScript. Running JavaScript can be either allowed for all websites or denied for all websites.

If this policy is left not set, 'AllowJavaScript' will be used and the user will be able to change it.

• 1 = Allow all sites to run JavaScript
• 2 = Do not allow any site to run JavaScript

Example value:

0x00000001 (Windows), 1 (Linux), 1 (Android), 1 (Mac)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : JavascriptSettings

DefaultPluginsSetting

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultPluginsSetting

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultPluginsSetting

Mac/Linux preference name:

DefaultPluginsSetting

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 10
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set whether websites are allowed to automatically run the Flash plugin. Automatically running the Flash plugin can be either allowed for all websites or denied for all websites.

Click to play allows the Flash plugin to run but the user must click on the placeholder to start its execution.

Automatic playback is only allowed for domains explictly listed in the PluginsAllowedForUrls policy. If you want to enabled automatic playback for all sites consider adding http://* and https://* to this list.

If this policy is left not set, the user will be able to change this setting manually.

• 1 = Allow all sites to automatically run the Flash plugin
• 2 = Block the Flash plugin
• 3 = Click to play

Example value:

0x00000001 (Windows), 1 (Linux), 1 (Mac)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : PluginsSettings

DefaultPopupsSetting

Data type:

Integer [Android:choice, Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultPopupsSetting

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultPopupsSetting

Mac/Linux preference name:

DefaultPopupsSetting

Android restriction name:

DefaultPopupsSetting

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 10
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 33

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set whether websites are allowed to show pop-ups. Showing popups can be either allowed for all websites or denied for all websites.

If this policy is left not set, 'BlockPopups' will be used and the user will be able to change it.

• 1 = Allow all sites to show pop-ups
• 2 = Do not allow any site to show popups

Example value:

0x00000001 (Windows), 1 (Linux), 1 (Android), 1 (Mac)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : PopupsSettings

DefaultNotificationsSetting

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultNotificationsSetting

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultNotificationsSetting

Mac/Linux preference name:

DefaultNotificationsSetting

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 10
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set whether websites are allowed to display desktop notifications. Displaying desktop notifications can be allowed by default, denied by default or the user can be asked every time a website wants to show desktop notifications.

If this policy is left not set, 'AskNotifications' will be used and the user will be able to change it.

• 1 = Allow sites to show desktop notifications
• 2 = Do not allow any site to show desktop notifications
• 3 = Ask every time a site wants to show desktop notifications

Example value:

0x00000002 (Windows), 2 (Linux), 2 (Mac)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : NotificationsSettings

DefaultGeolocationSetting

Data type:

Integer [Android:choice, Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultGeolocationSetting

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultGeolocationSetting

Mac/Linux preference name:

DefaultGeolocationSetting

Android restriction name:

DefaultGeolocationSetting

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 10
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set whether websites are allowed to track the users' physical location. Tracking the users' physical location can be allowed by default, denied by default or the user can be asked every time a website requests the physical location.

If this policy is left not set, 'AskGeolocation' will be used and the user will be able to change it.

• 1 = Allow sites to track the users' physical location
• 2 = Do not allow any site to track the users' physical location
• 3 = Ask whenever a site wants to track the users' physical location

Note for Google Chrome OS devices supporting Android apps:

If this policy is set to BlockGeolocation, Android apps cannot access location information. If you set this policy to any other value or leave it unset, the user is asked to consent when an Android app wants to access location information.

Example value:

0x00000001 (Windows), 1 (Linux), 1 (Android), 1 (Mac)

DefaultMediaStreamSetting (deprecated)

DefaultWebBluetoothGuardSetting

Data type:

Integer [Android:choice, Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultWebBluetoothGuardSetting

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultWebBluetoothGuardSetting

Mac/Linux preference name:

DefaultWebBluetoothGuardSetting

Android restriction name:

DefaultWebBluetoothGuardSetting

Supported on:

• Google Chrome OS (Google Chrome OS) since version 50
• Google Chrome (Android) since version 50
• Google Chrome (Linux, Mac, Windows) since version 50

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set whether websites are allowed to get access to nearby Bluetooth devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to nearby Bluetooth devices.

If this policy is left not set, '3' will be used, and the user will be able to change it.

• 2 = Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API
• 3 = Allow sites to ask the user to grant access to a nearby Bluetooth device

Example value:

0x00000002 (Windows), 2 (Linux), 2 (Android), 2 (Mac)

DefaultWebUsbGuardSetting

Data type:

Integer [Android:choice, Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultWebUsbGuardSetting

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultWebUsbGuardSetting

Mac/Linux preference name:

DefaultWebUsbGuardSetting

Android restriction name:

DefaultWebUsbGuardSetting

Supported on:

• Google Chrome OS (Google Chrome OS) since version 67
• Google Chrome (Android) since version 67
• Google Chrome (Linux, Mac, Windows) since version 67

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set whether websites are allowed to get access to connected USB devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to connected USB devices.

This policy can be overridden for specific URL patterns using the 'WebUsbAskForUrls' and 'WebUsbBlockedForUrls' policies.

If this policy is left not set, '3' will be used, and the user will be able to change it.

• 2 = Do not allow any site to request access to USB devices via the WebUSB API
• 3 = Allow sites to ask the user to grant access to a connected USB device

Example value:

0x00000002 (Windows), 2 (Linux), 2 (Android), 2 (Mac)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : WebUsbSettings

AutoSelectCertificateForUrls

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\AutoSelectCertificateForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\AutoSelectCertificateForUrls

Mac/Linux preference name:

AutoSelectCertificateForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 15
• Google Chrome OS (Google Chrome OS) since version 15

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to specify a list of url patterns that specify sites for which Google Chrome should automatically select a client certificate, if the site requests a certificate.

The value must be an array of stringified JSON dictionaries. Each dictionary must have the form { "pattern": "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts from which client certificates the browser will automatically select. Independent of the filter, only certificates will be selected that match the server's certificate request. For example, if $FILTER has the form { "ISSUER": { "CN": "$ISSUER_CN" } }, additionally only client certificates are selected that are issued by a certificate with the CommonName $ISSUER_CN. If $FILTER contains an "ISSUER" and a "SUBJECT" section, a client certificate must satisfy both conditions to be selected. If $FILTER specifies an organization ("O"), a certificate must have at least one organization which matches the specified value to be selected. If $FILTER specifies an organization unit ("OU"), a certificate must have at least one organization unit which matches the specified value to be selected. If $FILTER is the empty dictionary {}, the selection of client certificates is not additionally restricted.

If this policy is left not set, no auto-selection will be done for any site.

Schema:

{ "items": { "properties": { "filter": { "properties": { "ISSUER": { "id": "CertPrincipalFields", "properties": { "CN": { "type": "string" }, "L": { "type": "string" }, "O": { "type": "string" }, "OU": { "type": "string" } }, "type": "object" }, "SUBJECT": { "$ref": "CertPrincipalFields" } }, "type": "object" }, "pattern": { "type": "string" } }, "type": "object" }, "type": "array" }

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\AutoSelectCertificateForUrls\1 = "{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\AutoSelectCertificateForUrls\1 = "{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}"

Android/Linux:

[ "{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}" ]

Mac:

<array> <string>{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}</string> </array>

CookiesAllowedForUrls

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\CookiesAllowedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\CookiesAllowedForUrls

Mac/Linux preference name:

CookiesAllowedForUrls

Android restriction name:

CookiesAllowedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are allowed to set cookies.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultCookiesSetting' policy if it is set, or the user's personal configuration otherwise.

See also policies 'CookiesBlockedForUrls' and 'CookiesSessionOnlyForUrls'. Note that there must be no conflicting URL patterns between these three policies - it is unspecified which policy takes precedence.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\CookiesAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\CookiesAllowedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\CookiesAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\CookiesAllowedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

CookiesBlockedForUrls

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\CookiesBlockedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\CookiesBlockedForUrls

Mac/Linux preference name:

CookiesBlockedForUrls

Android restriction name:

CookiesBlockedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are not allowed to set cookies.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultCookiesSetting' policy if it is set, or the user's personal configuration otherwise.

See also policies 'CookiesAllowedForUrls' and 'CookiesSessionOnlyForUrls'. Note that there must be no conflicting URL patterns between these three policies - it is unspecified which policy takes precedence.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\CookiesBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\CookiesBlockedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\CookiesBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\CookiesBlockedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

CookiesSessionOnlyForUrls

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\CookiesSessionOnlyForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\CookiesSessionOnlyForUrls

Mac/Linux preference name:

CookiesSessionOnlyForUrls

Android restriction name:

CookiesSessionOnlyForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Cookies set by pages matching these URL patterns will be limited to the current session, i.e. they will be deleted when the browser exits.

For URLs not covered by the patterns specified here, or for all URLs if this policy is not set, the global default value will be used either from the 'DefaultCookiesSetting' policy, if it is set, or the user's personal configuration otherwise.

Note that if Google Chrome is running in 'background mode', the session may not be closed when the last browser window is closed, but will instead stay active until the browser exits. Please see the 'BackgroundModeEnabled' policy for more information about configuring this behavior.

See also policies 'CookiesAllowedForUrls' and 'CookiesBlockedForUrls'. Note that there must be no conflicting URL patterns between these three policies - it is unspecified which policy takes precedence.

If the "RestoreOnStartup" policy is set to restore URLs from previous sessions this policy will not be respected and cookies will be stored permanently for those sites.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\CookiesSessionOnlyForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\CookiesSessionOnlyForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\CookiesSessionOnlyForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\CookiesSessionOnlyForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

ImagesAllowedForUrls

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ImagesAllowedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ImagesAllowedForUrls

Mac/Linux preference name:

ImagesAllowedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are allowed to display images.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultImagesSetting' policy if it is set, or the user's personal configuration otherwise.

Note that previously this policy was erroneously enabled on Android, but this functionality has never been fully supported on Android.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\ImagesAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\ImagesAllowedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ImagesAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\ImagesAllowedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

ImagesBlockedForUrls

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ImagesBlockedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ImagesBlockedForUrls

Mac/Linux preference name:

ImagesBlockedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are not allowed to display images.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultImagesSetting' policy if it is set, or the user's personal configuration otherwise.

Note that previously this policy was erroneously enabled on Android, but this functionality has never been fully supported on Android.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\ImagesBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\ImagesBlockedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ImagesBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\ImagesBlockedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

JavaScriptAllowedForUrls

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\JavaScriptAllowedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\JavaScriptAllowedForUrls

Mac/Linux preference name:

JavaScriptAllowedForUrls

Android restriction name:

JavaScriptAllowedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are allowed to run JavaScript.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultJavaScriptSetting' policy if it is set, or the user's personal configuration otherwise.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\JavaScriptAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\JavaScriptAllowedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\JavaScriptAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\JavaScriptAllowedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

JavaScriptBlockedForUrls

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\JavaScriptBlockedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\JavaScriptBlockedForUrls

Mac/Linux preference name:

JavaScriptBlockedForUrls

Android restriction name:

JavaScriptBlockedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are not allowed to run JavaScript.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultJavaScriptSetting' policy if it is set, or the user's personal configuration otherwise.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\JavaScriptBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\JavaScriptBlockedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\JavaScriptBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\JavaScriptBlockedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

PluginsAllowedForUrls

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\PluginsAllowedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PluginsAllowedForUrls

Mac/Linux preference name:

PluginsAllowedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are allowed to run the Flash plugin.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultPluginsSetting' policy if it is set, or the user's personal configuration otherwise.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\PluginsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\PluginsAllowedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\PluginsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\PluginsAllowedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

PluginsBlockedForUrls

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\PluginsBlockedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PluginsBlockedForUrls

Mac/Linux preference name:

PluginsBlockedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are not allowed to run the Flash plugin.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultPluginsSetting' policy if it is set, or the user's personal configuration otherwise.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\PluginsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\PluginsBlockedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\PluginsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\PluginsBlockedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

PopupsAllowedForUrls

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\PopupsAllowedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PopupsAllowedForUrls

Mac/Linux preference name:

PopupsAllowedForUrls

Android restriction name:

PopupsAllowedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 34

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are allowed to open popups.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultPopupsSetting' policy if it is set, or the user's personal configuration otherwise.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\PopupsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\PopupsAllowedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\PopupsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\PopupsAllowedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

RegisteredProtocolHandlers

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\Recommended\RegisteredProtocolHandlers

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\Recommended\RegisteredProtocolHandlers

Mac/Linux preference name:

RegisteredProtocolHandlers

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 37
• Google Chrome OS (Google Chrome OS) since version 37

Supported features:

Can Be Mandatory: No, Can Be Recommended: Yes, Dynamic Policy Refresh: No, Per Profile: Yes

Description:

Allows you to register a list of protocol handlers. This can only be a recommended policy. The property |protocol| should be set to the scheme such as 'mailto' and the property |url| should be set to the URL pattern of the application that handles the scheme. The pattern can include a '%s', which if present will be replaced by the handled URL.

The protocol handlers registered by policy are merged with the ones registered by the user and both are available for use. The user can override the protocol handlers installed by policy by installing a new default handler, but cannot remove a protocol handler registered by policy.

Note for Google Chrome OS devices supporting Android apps:

The protocol handlers set via this policy are not used when handling Android intents.

Schema:

{ "items": { "properties": { "default": { "description": "A boolean flag indicating if the protocol handler should be set as the default.", "type": "boolean" }, "protocol": { "description": "The protocol for the protocol handler.", "type": "string" }, "url": { "description": "The URL of the protocol handler.", "type": "string" } }, "required": [ "protocol", "url" ], "type": "object" }, "type": "array" }

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\Recommended\RegisteredProtocolHandlers = [ { "default": true, "protocol": "mailto", "url": "https://mail.google.com/mail/?extsrc=mailto&url=%s" } ]

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\Recommended\RegisteredProtocolHandlers = [ { "default": true, "protocol": "mailto", "url": "https://mail.google.com/mail/?extsrc=mailto&url=%s" } ]

Android/Linux:

RegisteredProtocolHandlers: [ { "default": true, "protocol": "mailto", "url": "https://mail.google.com/mail/?extsrc=mailto&url=%s" } ]

Mac:

<key>RegisteredProtocolHandlers</key> <array> <dict> <key>default</key> <true/> <key>protocol</key> <string>mailto</string> <key>url</key> <string>https://mail.google.com/mail/?extsrc=mailto&amp;url=%s</string> </dict> </array>

PopupsBlockedForUrls

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\PopupsBlockedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PopupsBlockedForUrls

Mac/Linux preference name:

PopupsBlockedForUrls

Android restriction name:

PopupsBlockedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 11
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 34

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are not allowed to open popups.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultPopupsSetting' policy if it is set, or the user's personal configuration otherwise.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\PopupsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\PopupsBlockedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\PopupsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\PopupsBlockedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

NotificationsAllowedForUrls

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\NotificationsAllowedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NotificationsAllowedForUrls

Mac/Linux preference name:

NotificationsAllowedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 16
• Google Chrome OS (Google Chrome OS) since version 16

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are allowed to display notifications.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultNotificationsSetting' policy if it is set, or the user's personal configuration otherwise.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\NotificationsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\NotificationsAllowedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\NotificationsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\NotificationsAllowedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

NotificationsBlockedForUrls

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\NotificationsBlockedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NotificationsBlockedForUrls

Mac/Linux preference name:

NotificationsBlockedForUrls

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 16
• Google Chrome OS (Google Chrome OS) since version 16

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are not allowed to display notifications.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultNotificationsSetting' policy if it is set, or the user's personal configuration otherwise.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\NotificationsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\NotificationsBlockedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\NotificationsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\NotificationsBlockedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

WebUsbAllowDevicesForUrls

Data type:

Dictionary [Android:string, Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\WebUsbAllowDevicesForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\WebUsbAllowDevicesForUrls

Mac/Linux preference name:

WebUsbAllowDevicesForUrls

Android restriction name:

WebUsbAllowDevicesForUrls

Supported on:

• Google Chrome (Android) since version 75
• Google Chrome OS (Google Chrome OS) since version 74
• Google Chrome (Linux, Mac, Windows) since version 74

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of urls that specify which sites will automatically be granted permission to access a USB device with the given vendor and product IDs. Each item in the list must contain both devices and urls in order for the policy to be valid. Each item in devices can contain a vendor ID and product ID field. Any ID that is omitted is treated as a wildcard with one exception, and that exception is that a product ID cannot be specified without a vendor ID also being specified. Otherwise, the policy will not be valid and will be ignored.

The USB permission model uses the URL of the requesting site ("requesting URL") and the URL of the top-level frame site ("embedding URL") to grant permission to the requesting URL to access the USB device. The requesting URL may be different than the embedding URL when the requesting site is loaded in an iframe. Therefore, the "urls" field can contain up to two URL strings delimited by a comma to specify the requesting and embedding URL respectively. If only one URL is specified, then access to the corresponding USB devices will be granted when the requesting site's URL matches this URL regardless of embedding status. The URLs in "urls" must be valid URLs, otherwise the policy will be ignored.

If this policy is left not set, the global default value will be used for all sites either from the 'DefaultWebUsbGuardSetting' policy if it is set, or the user's personal configuration otherwise.

URL patterns in this policy should not clash with the ones configured via WebUsbBlockedForUrls. If there is a clash, this policy will take precedence over WebUsbBlockedForUrls and WebUsbAskForUrls.

Values for this policy and the DeviceWebUsbAllowDevicesForUrls policy are merged together.

Schema:

{ "items": { "properties": { "devices": { "items": { "properties": { "product_id": { "type": "integer" }, "vendor_id": { "type": "integer" } }, "type": "object" }, "type": "array" }, "urls": { "items": { "type": "string" }, "type": "array" } }, "required": [ "devices", "urls" ], "type": "object" }, "type": "array" }

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\WebUsbAllowDevicesForUrls = [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com", "https://requesting.com,https://embedded.com" ] } ]

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\WebUsbAllowDevicesForUrls = [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com", "https://requesting.com,https://embedded.com" ] } ]

Android/Linux:

WebUsbAllowDevicesForUrls: [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com", "https://requesting.com,https://embedded.com" ] } ]

Mac:

<key>WebUsbAllowDevicesForUrls</key> <array> <dict> <key>devices</key> <array> <dict> <key>product_id</key> <integer>5678</integer> <key>vendor_id</key> <integer>1234</integer> </dict> </array> <key>urls</key> <array> <string>https://google.com</string> <string>https://requesting.com,https://embedded.com</string> </array> </dict> </array>

WebUsbAskForUrls

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\WebUsbAskForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\WebUsbAskForUrls

Mac/Linux preference name:

WebUsbAskForUrls

Android restriction name:

WebUsbAskForUrls

Supported on:

• Google Chrome OS (Google Chrome OS) since version 68
• Google Chrome (Android) since version 68
• Google Chrome (Linux, Mac, Windows) since version 68

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are allowed to ask the user to grant them access to a USB device.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultWebUsbGuardSetting' policy if it is set, or the user's personal configuration otherwise.

URL patterns in this policy should not clash with ones configured via WebUsbBlockedForUrls. It is unspecified which of the two policies takes precedence if a URL matches with both.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\WebUsbAskForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\WebUsbAskForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\WebUsbAskForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\WebUsbAskForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

WebUsbBlockedForUrls

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\WebUsbBlockedForUrls

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\WebUsbBlockedForUrls

Mac/Linux preference name:

WebUsbBlockedForUrls

Android restriction name:

WebUsbBlockedForUrls

Supported on:

• Google Chrome OS (Google Chrome OS) since version 68
• Google Chrome (Android) since version 68
• Google Chrome (Linux, Mac, Windows) since version 68

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to set a list of url patterns that specify sites which are prevented from asking the user to grant them access to a USB device.

If this policy is left not set the global default value will be used for all sites either from the 'DefaultWebUsbGuardSetting' policy if it is set, or the user's personal configuration otherwise.

URL patterns in this policy should not clash with ones configured via WebUsbAskForUrls. It is unspecified which of the two policies takes precedence if a URL matches with both.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\WebUsbBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\Chrome\WebUsbBlockedForUrls\2 = "[*.]example.edu"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\WebUsbBlockedForUrls\1 = "https://www.example.com" Software\Policies\Google\ChromeOS\WebUsbBlockedForUrls\2 = "[*.]example.edu"

Android/Linux:

[ "https://www.example.com", "[*.]example.edu" ]

Mac:

<array> <string>https://www.example.com</string> <string>[*.]example.edu</string> </array>

Date and time

SystemTimezone

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\SystemTimezone

Supported on:

• Google Chrome OS (Google Chrome OS) since version 22

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the enforced timezone to be used for the device. When this policy is set, users on the device cannot override the specified timezone. If an invalid value is provided, the policy is still activated using "GMT" instead. If an empty string is provided, the policy is ignored.

If this policy is not used, the currently active timezone will remain in use however users can change the timezone.

New devices start out with the timezone set to "US/Pacific".

The format of the value follows the names of timezones in the "IANA Time Zone Database" (see "https://en.wikipedia.org/wiki/Tz_database"). In particular, most timezones can be referred to by "continent/large_city" or "ocean/large_city".

Setting this policy completely disables automatic timezone resolve by device location. It also overrides SystemTimezoneAutomaticDetection policy.

Example value:

"America/Los_Angeles"

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : DateAndTime

SystemTimezoneAutomaticDetection

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\SystemTimezoneAutomaticDetection

Supported on:

• Google Chrome OS (Google Chrome OS) since version 53

Supported features:

Dynamic Policy Refresh: Yes

Description:

When this policy is set, automatic timezone detection flow will be in one of the following ways depending on the value of the setting:

If set to TimezoneAutomaticDetectionUsersDecide, users would be able to control automatic timezone detection using normal controls in chrome://settings.

If set to TimezoneAutomaticDetectionDisabled, automatic timezone controls in chrome://settings will be disabled. Automatic timezone detection will be always off.

If set to TimezoneAutomaticDetectionIPOnly, timezone controls in chrome://settings will be disabled. Automatic timezone detection will be always on. Timezone detection will use IP-only method to resolve location.

If set to TimezoneAutomaticDetectionSendWiFiAccessPoints, timezone controls in chrome://settings will be disabled. Automatic timezone detection will be always on. The list of visible WiFi access-points will be always sent to Geolocation API server for fine-grained timezone detection.

If set to TimezoneAutomaticDetectionSendAllLocationInfo, timezone controls in chrome://settings will be disabled. Automatic timezone detection will be always on. Location information (such as WiFi access-points, reachable Cell Towers, GPS) will be sent to a server for fine-grained timezone detection.

If this policy is not set, it will behave as if TimezoneAutomaticDetectionUsersDecide is set.

If SystemTimezone policy is set, it overrides this policy. In this case automatic timezone detection is completely disabled.

• 0 = Let users decide
• 1 = Never auto-detect timezone
• 2 = Always use coarse timezone detection
• 3 = Always send WiFi access-points to server while resolving timezone
• 4 = Always send any available location signals to the server while resolving timezone

Example value:

0x00000000 (Windows)

SystemUse24HourClock

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\SystemUse24HourClock

Supported on:

• Google Chrome OS (Google Chrome OS) since version 30

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the clock format be used for the device.

This policy configures the clock format to use on the login screen and as a default for user sessions. Users can still override the clock format for their account.

If the policy is set to true, the device will use a 24 hour clock format. If the policy is set to false, the device will use 12 hour clock format.

If this policy is not set, the device will default to a 24 hour clock format.

Example value:

0x00000001 (Windows)

Default search provider

DefaultSearchProviderEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderEnabled

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderEnabled

Mac/Linux preference name:

DefaultSearchProviderEnabled

Android restriction name:

DefaultSearchProviderEnabled

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enables the use of a default search provider.

If you enable this setting, a default search is performed when the user types text in the omnibox that is not a URL.

You can specify the default search provider to be used by setting the rest of the default search policies. If these are left empty, the user can choose the default provider.

If you disable this setting, no search is performed when the user enters non-URL text in the omnibox.

If you enable or disable this setting, users cannot change or override this setting in Google Chrome.

If this policy is left not set, the default search provider is enabled, and the user will be able to set the search provider list.

This policy is available only on Windows instances that are joined to a Microsoft® Active Directory® domain. or Windows 10 Pro or Enterprise instances that enrolled for device management.

Example value:

0x00000001 (Windows), true (Linux), true (Android), <true /> (Mac)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : DefaultSearchProvider

DefaultSearchProviderName

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderName

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderName

Mac/Linux preference name:

DefaultSearchProviderName

Android restriction name:

DefaultSearchProviderName

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the name of the default search provider. If left empty or not set, the host name specified by the search URL will be used.

This policy is only considered if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

"My Intranet Search"

DefaultSearchProviderKeyword

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderKeyword

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderKeyword

Mac/Linux preference name:

DefaultSearchProviderKeyword

Android restriction name:

DefaultSearchProviderKeyword

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the keyword, which is the shortcut used in the omnibox to trigger the search for this provider.

This policy is optional. If not set, no keyword will activate the search provider.

This policy is only considered if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

"mis"

DefaultSearchProviderSearchURL

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderSearchURL

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderSearchURL

Mac/Linux preference name:

DefaultSearchProviderSearchURL

Android restriction name:

DefaultSearchProviderSearchURL

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the URL of the search engine used when doing a default search. The URL should contain the string '{searchTerms}', which will be replaced at query time by the terms the user is searching for.

Google's search URL can be specified as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.

This option must be set when the 'DefaultSearchProviderEnabled' policy is enabled and will only be respected if this is the case.

Example value:

"https://search.my.company/search?q={searchTerms}"

DefaultSearchProviderSuggestURL

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderSuggestURL

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderSuggestURL

Mac/Linux preference name:

DefaultSearchProviderSuggestURL

Android restriction name:

DefaultSearchProviderSuggestURL

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the URL of the search engine used to provide search suggestions. The URL should contain the string '{searchTerms}', which will be replaced at query time by the text the user has entered so far.

This policy is optional. If not set, no suggest URL will be used.

Google's suggest URL can be specified as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.

This policy is only respected if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

"https://search.my.company/suggest?q={searchTerms}"

DefaultSearchProviderIconURL

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderIconURL

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderIconURL

Mac/Linux preference name:

DefaultSearchProviderIconURL

Android restriction name:

DefaultSearchProviderIconURL

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the favorite icon URL of the default search provider.

This policy is optional. If not set, no icon will be present for the search provider.

This policy is only respected if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

"https://search.my.company/favicon.ico"

DefaultSearchProviderEncodings

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderEncodings

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderEncodings

Mac/Linux preference name:

DefaultSearchProviderEncodings

Android restriction name:

DefaultSearchProviderEncodings

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the character encodings supported by the search provider. Encodings are code page names like UTF-8, GB2312, and ISO-8859-1. They are tried in the order provided.

This policy is optional. If not set, the default will be used which is UTF-8.

This policy is only respected if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\DefaultSearchProviderEncodings\1 = "UTF-8" Software\Policies\Google\Chrome\DefaultSearchProviderEncodings\2 = "UTF-16" Software\Policies\Google\Chrome\DefaultSearchProviderEncodings\3 = "GB2312" Software\Policies\Google\Chrome\DefaultSearchProviderEncodings\4 = "ISO-8859-1"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DefaultSearchProviderEncodings\1 = "UTF-8" Software\Policies\Google\ChromeOS\DefaultSearchProviderEncodings\2 = "UTF-16" Software\Policies\Google\ChromeOS\DefaultSearchProviderEncodings\3 = "GB2312" Software\Policies\Google\ChromeOS\DefaultSearchProviderEncodings\4 = "ISO-8859-1"

Android/Linux:

[ "UTF-8", "UTF-16", "GB2312", "ISO-8859-1" ]

Mac:

<array> <string>UTF-8</string> <string>UTF-16</string> <string>GB2312</string> <string>ISO-8859-1</string> </array>

DefaultSearchProviderAlternateURLs

Data type:

List of strings [Android:string] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderAlternateURLs

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderAlternateURLs

Mac/Linux preference name:

DefaultSearchProviderAlternateURLs

Android restriction name:

DefaultSearchProviderAlternateURLs

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 24
• Google Chrome OS (Google Chrome OS) since version 24
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies a list of alternate URLs that can be used to extract search terms from the search engine. The URLs should contain the string '{searchTerms}', which will be used to extract the search terms.

This policy is optional. If not set, no alternate urls will be used to extract search terms.

This policy is only respected if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\DefaultSearchProviderAlternateURLs\1 = "https://search.my.company/suggest#q={searchTerms}" Software\Policies\Google\Chrome\DefaultSearchProviderAlternateURLs\2 = "https://search.my.company/suggest/search#q={searchTerms}"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DefaultSearchProviderAlternateURLs\1 = "https://search.my.company/suggest#q={searchTerms}" Software\Policies\Google\ChromeOS\DefaultSearchProviderAlternateURLs\2 = "https://search.my.company/suggest/search#q={searchTerms}"

Android/Linux:

[ "https://search.my.company/suggest#q={searchTerms}", "https://search.my.company/suggest/search#q={searchTerms}" ]

Mac:

<array> <string>https://search.my.company/suggest#q={searchTerms}</string> <string>https://search.my.company/suggest/search#q={searchTerms}</string> </array>

DefaultSearchProviderImageURL

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderImageURL

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderImageURL

Mac/Linux preference name:

DefaultSearchProviderImageURL

Android restriction name:

DefaultSearchProviderImageURL

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 29
• Google Chrome OS (Google Chrome OS) since version 29
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the URL of the search engine used to provide image search. Search requests will be sent using the GET method. If the DefaultSearchProviderImageURLPostParams policy is set then image search requests will use the POST method instead.

This policy is optional. If not set, no image search will be used.

This policy is only respected if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

"https://search.my.company/searchbyimage/upload"

DefaultSearchProviderNewTabURL

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderNewTabURL

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderNewTabURL

Mac/Linux preference name:

DefaultSearchProviderNewTabURL

Android restriction name:

DefaultSearchProviderNewTabURL

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 30
• Google Chrome OS (Google Chrome OS) since version 30
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the URL that a search engine uses to provide a new tab page.

This policy is optional. If not set, no new tab page will be provided.

This policy is only respected if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

"https://search.my.company/newtab"

DefaultSearchProviderSearchURLPostParams

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderSearchURLPostParams

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderSearchURLPostParams

Mac/Linux preference name:

DefaultSearchProviderSearchURLPostParams

Android restriction name:

DefaultSearchProviderSearchURLPostParams

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 29
• Google Chrome OS (Google Chrome OS) since version 29
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the parameters used when searching a URL with POST. It consists of comma-separated name/value pairs. If a value is a template parameter, like {searchTerms} in above example, it will be replaced with real search terms data.

This policy is optional. If not set, search request will be sent using the GET method.

This policy is only respected if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

"q={searchTerms},ie=utf-8,oe=utf-8"

DefaultSearchProviderSuggestURLPostParams

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderSuggestURLPostParams

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderSuggestURLPostParams

Mac/Linux preference name:

DefaultSearchProviderSuggestURLPostParams

Android restriction name:

DefaultSearchProviderSuggestURLPostParams

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 29
• Google Chrome OS (Google Chrome OS) since version 29
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the parameters used when doing suggestion search with POST. It consists of comma-separated name/value pairs. If a value is a template parameter, like {searchTerms} in above example, it will be replaced with real search terms data.

This policy is optional. If not set, suggest search request will be sent using the GET method.

This policy is only respected if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

"q={searchTerms},ie=utf-8,oe=utf-8"

DefaultSearchProviderImageURLPostParams

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultSearchProviderImageURLPostParams

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultSearchProviderImageURLPostParams

Mac/Linux preference name:

DefaultSearchProviderImageURLPostParams

Android restriction name:

DefaultSearchProviderImageURLPostParams

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 29
• Google Chrome OS (Google Chrome OS) since version 29
• Google Chrome (Android) since version 30

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the parameters used when doing image search with POST. It consists of comma-separated name/value pairs. If a value is a template parameter, like {imageThumbnail} in above example, it will be replaced with real image thumbnail data.

This policy is optional. If not set, image search request will be sent using the GET method.

This policy is only respected if the 'DefaultSearchProviderEnabled' policy is enabled.

Example value:

"content={imageThumbnail},url={imageURL},sbisrc={SearchSource}"

Device update settings

ChromeOsReleaseChannel

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ChromeOsReleaseChannel

Supported on:

• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the release channel that this device should be locked to.

• "stable-channel" = Stable channel
• "beta-channel" = Beta channel
• "dev-channel" = Dev channel (may be unstable)

Example value:

"stable-channel"

ChromeOsReleaseChannelDelegated

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ChromeOsReleaseChannelDelegated

Supported on:

• Google Chrome OS (Google Chrome OS) since version 19

Supported features:

Dynamic Policy Refresh: Yes

Description:

If this policy is set to True and the ChromeOsReleaseChannel policy is not specified then users of the enrolling domain will be allowed to change the release channel of the device. If this policy is set to false the device will be locked in whatever channel it was last set.

The user selected channel will be overridden by the ChromeOsReleaseChannel policy, but if the policy channel is more stable than the one that was installed on the device, then the channel will only switch after the version of the more stable channel reaches a higher version number than the one installed on the device.

Example value:

0x00000000 (Windows)

DeviceAutoUpdateDisabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceAutoUpdateDisabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 19

Supported features:

Dynamic Policy Refresh: Yes

Description:

Disables automatic updates when set to True.

Google Chrome OS devices automatically check for updates when this setting is not configured or set to False.

Warning: It is recommended to keep auto-updates enabled so that users receive software updates and critical security fixes. Turning off auto-updates might leave users at risk.

Example value:

0x00000001 (Windows)

DeviceAutoUpdateP2PEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceAutoUpdateP2PEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 31

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies whether p2p is to be used for OS update payloads. If set to True, devices will share and attempt to consume update payloads on the LAN, potentially reducing Internet bandwidth usage and congestion. If the update payload is not available on the LAN, the device will fall back to downloading from an update server. If set to False or not configured, p2p will not be used.

Example value:

0x00000000 (Windows)

DeviceAutoUpdateTimeRestrictions

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceAutoUpdateTimeRestrictions

Supported on:

• Google Chrome OS (Google Chrome OS) since version 69

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

This policy controls the time frames during which the Google Chrome OS device is not allowed to check for updates automatically. When this policy is set to a non-empty list of time intervals: Devices will not be able to check for updates automatically during the specified time intervals. Devices that require a rollback or are below the minimum Google Chrome OS version will not be affected by this policy due to potential security issues. Furthermore, this policy will not block update checks requested by users or administrators. When this policy is unset or contains no time intervals: No automatic update checks will be blocked by this policy, but they may be blocked by other policies. This feature is only enabled on Chrome devices configured as auto-launch kiosks. Other devices will not be restricted by this policy.

Schema:

{ "items": { "description": "Time interval that spans at most one week. If the start time is later than the end time, then the interval will wrap around.", "properties": { "end": { "$ref": "DisallowedTimeInterval", "description": "End of the interval, exclusive." }, "start": { "description": "Start time of the interval, inclusive.", "id": "DisallowedTimeInterval", "properties": { "day_of_week": { "description": "Day of the week for the interval.", "enum": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "type": "string" }, "hours": { "description": "Hours elapsed since the start of the day in (24 hour format).", "maximum": 23, "minimum": 0, "type": "integer" }, "minutes": { "description": "Minutes elapsed in the current hour.", "maximum": 59, "minimum": 0, "type": "integer" } }, "required": [ "day_of_week", "minutes", "hours" ], "type": "object" } }, "required": [ "start", "end" ], "type": "object" }, "type": "array" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DeviceAutoUpdateTimeRestrictions = [ { "end": { "day_of_week": "Thursday", "hours": 2, "minutes": 30 }, "start": { "day_of_week": "Monday", "hours": 3, "minutes": 50 } }, { "end": { "day_of_week": "Sunday", "hours": 15, "minutes": 10 }, "start": { "day_of_week": "Thursday", "hours": 3, "minutes": 30 } } ]

DeviceTargetVersionPrefix

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceTargetVersionPrefix

Supported on:

• Google Chrome OS (Google Chrome OS) since version 19

Supported features:

Dynamic Policy Refresh: Yes

Description:

Sets a target version for Auto Updates.

Specifies the prefix of a target version Google Chrome OS should update to. If the device is running a version that's before the specified prefix, it will update to the latest version with the given prefix. If the device is already on a later version, effects depend on the value of DeviceRollbackToTargetVersion. The prefix format works component-wise as is demonstrated in the following example:

"" (or not configured): update to latest version available. "1412.": update to any minor version of 1412 (e.g. 1412.24.34 or 1412.60.2) "1412.2.": update to any minor version of 1412.2 (e.g. 1412.2.34 or 1412.2.2) "1412.24.34": update to this specific version only

Warning: It is not recommended to configure version restrictions as they may prevent users from receiving software updates and critical security fixes. Restricting updates to a specific version prefix might leave users at risk.

Example value:

"1412."

DeviceUpdateStagingSchedule

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceUpdateStagingSchedule

Supported on:

• Google Chrome OS (Google Chrome OS) since version 69

Supported features:

Dynamic Policy Refresh: Yes

Description:

This policy defines a list of percentages that will define the fraction of Google Chrome OS devices in the OU to update per day starting from the day the update is first discovered. The discovery time is later than the update published time, since it could be a while after the update publishing until the device checks for updates.

Each (day, percentage) pair contains which percentage of the fleet has to be updated by the given number of days since the update has been discovered. For example, if we have the pairs [(4, 40), (10, 70), (15, 100)], then 40% of the fleet should have been updated 4 days after seeing the update. 70% should be updated after 10 days, and so on.

If there is a value defined for this policy, updates will ignore the DeviceUpdateScatterFactor policy and follow this policy instead.

If this list is empty, there will be no staging and updates will be applied according to other device policies.

This policy does not apply for channel switches.

Schema:

{ "items": { "description": "Contains the number of days and the percentage of the fleet that should be updated after those days have passed.", "id": "DayPercentagePair", "properties": { "days": { "description": "Days from update discovery.", "maximum": 28, "minimum": 1, "type": "integer" }, "percentage": { "description": "Percentage of the fleet that should be updated after the given days.", "maximum": 100, "minimum": 0, "type": "integer" } }, "type": "object" }, "type": "array" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DeviceUpdateStagingSchedule = [ { "days": 7, "percentage": 50 }, { "days": 10, "percentage": 100 } ]

DeviceUpdateScatterFactor

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceUpdateScatterFactor

Supported on:

• Google Chrome OS (Google Chrome OS) since version 20

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the number of seconds up to which a device may randomly delay its download of an update from the time the update was first pushed out to the server. The device may wait a portion of this time in terms of wall-clock-time and the remaining portion in terms of the number of update checks. In any case, the scatter is upper bounded to a constant amount of time so that a device does not ever get stuck waiting to download an update forever.

Example value:

0x00001c20 (Windows)

DeviceUpdateAllowedConnectionTypes

Data type:

List of strings

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceUpdateAllowedConnectionTypes

Supported on:

• Google Chrome OS (Google Chrome OS) since version 21

Supported features:

Dynamic Policy Refresh: Yes

Description:

The types of connections that are allowed to use for OS updates. OS updates potentially put heavy strain on the connection due to their size and may incur additional cost. Therefore, they are by default not enabled for connection types that are considered expensive, which include WiMax, Bluetooth and Cellular at the moment.

The recognized connection type identifiers are "ethernet", "wifi", "wimax", "bluetooth" and "cellular".

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DeviceUpdateAllowedConnectionTypes\1 = "ethernet"

DeviceUpdateHttpDownloadsEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceUpdateHttpDownloadsEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Dynamic Policy Refresh: Yes

Description:

Auto-update payloads on Google Chrome OS can be downloaded via HTTP instead of HTTPS. This allows transparent HTTP caching of HTTP downloads.

If this policy is set to true, Google Chrome OS will attempt to download auto-update payloads via HTTP. If the policy is set to false or not set, HTTPS will be used for downloading auto-update payloads.

Example value:

0x00000001 (Windows)

RebootAfterUpdate

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\RebootAfterUpdate

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Dynamic Policy Refresh: Yes

Description:

Schedule an automatic reboot after a Google Chrome OS update has been applied.

When this policy is set to true, an automatic reboot is scheduled when a Google Chrome OS update has been applied and a reboot is required to complete the update process. The reboot is scheduled immediately but may be delayed on the device by up to 24 hours if a user is currently using the device.

When this policy is set to false, no automatic reboot is scheduled after applying a Google Chrome OS update. The update process is completed when the user next reboots the device.

If you set this policy, users cannot change or override it.

Note: Currently, automatic reboots are only enabled while the login screen is being shown or a kiosk app session is in progress. This will change in the future and the policy will always apply, regardless of whether a session of any particular type is in progress or not.

Example value:

0x00000001 (Windows)

MinimumRequiredChromeVersion

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\MinimumRequiredChromeVersion

Supported on:

• Google Chrome OS (Google Chrome OS) since version 64

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Configures the requirement of the minimum allowed version of Google Chrome. Versions below given are treated as obsolete and device would not allow user sign in before OS is updated. If current version becomes obsolete during user session, user will be forcefully signed out.

If this policy is not set, no restrictions are applied, and user can sign regardless of Google Chrome version.

Here "Version" can be either an exact version like '61.0.3163.120' or a version prefix, like '61.0'

Example value:

"61.0.3163.120"

DeviceRollbackToTargetVersion

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceRollbackToTargetVersion

Supported on:

• Google Chrome OS (Google Chrome OS) since version 67

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies whether the device should roll back to the version set by DeviceTargetVersionPrefix if it's already running a later version.

Default is RollbackDisabled.

• 1 = Do not roll back to target version if OS version is newer than target. Updates are also disabled.
• 2 = Roll back and stay on target version if OS version is newer than target. Do a powerwash during the process.
• 3 = Roll back and stay on target version if OS version is newer than target. Try to carry over device-level configuration (including network credentials) through the rollback process, if possible, but do the rollback with full powerwash even if restoring the data is not possible (because the target version doesn't support restoring data or because of a backward-incompatible change). Supported on Google Chrome OS version 75 and higher. For older clients, this value means that rollback is disabled.

Example value:

0x00000001 (Windows)

DeviceRollbackAllowedMilestones

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceRollbackAllowedMilestones

Supported on:

• Google Chrome OS (Google Chrome OS) since version 67

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the minimum number of Google Chrome OS milestones rollback should be allowed starting from the stable version at any time.

Default is 0 for consumer, 4 (approx. half a year) for enterprise enrolled devices.

Setting this policy prevents rollback protection to apply for at least this number of milestones.

Setting this policy to a lower value has a permanent effect: the device MAY not be able to roll back to earlier versions even after the policy is reset to a larger value.

Actual rollback possibilities may also depend on the board and critical vulnerability patches.

Restrictions:

• Minimum:0
• Maximum:4

Example value:

0x00000004 (Windows)

DeviceQuickFixBuildToken

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceQuickFixBuildToken

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

This policy controls whether or not the device should be updated to a Quick Fix Build.

If policy value is set to a token that maps to a Quick Fix Build, the device will be updated to the corresponding Quick Fix Build if the update is not blocked by another policy.

If this policy is not set, or if its value does not map to a Quick Fix Build, then the device won't be updated to a Quick Fix Build. If the device is already running a Quick Fix Build and the policy is not set anymore or its value does not map to a Quick Fix Build anymore, then the device will be updated to a regular build if the update is not blocked by another policy.

Example value:

"sometoken"

Display

DeviceDisplayResolution

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceDisplayResolution

Supported on:

• Google Chrome OS (Google Chrome OS) since version 72

Supported features:

Can Be Recommended: No, Dynamic Policy Refresh: Yes, Per Profile: No

Description:

When this policy is set, resolution and scale factor of each display are set to the specified values. External display settings are applied to all connected external displays.

Values of "external_width" and "external_height" should be specified in pixels. Values of "external_scale_percentage" and "internal_scale_percentage" should be specified in percents.

If "external_use_native" is set to true, policy will ignore values of "external_height" and "external_width" and set resolution of the external displays to their native resolution.

If "external_use_native" is false or not provided and either "external_height" or "external_width" is not provided, policy doesn't affect the external display settings. If specified resolution or scale factor is not supported by some display, policy is not applied to that display.

If "recommended" flag is set to true, users may change resolution and scale factor of any display via the settings page after logging in, but their settings will be overriden by the policy value at the next reboot. If "recommended" flag is set to false or not set, users can't change the display settings.

Schema:

{ "properties": { "external_height": { "minimum": 1, "type": "integer" }, "external_scale_percentage": { "minimum": 1, "type": "integer" }, "external_use_native": { "type": "boolean" }, "external_width": { "minimum": 1, "type": "integer" }, "internal_scale_percentage": { "minimum": 1, "type": "integer" }, "recommended": { "type": "boolean" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DeviceDisplayResolution = { "external_height": 1080, "external_scale_percentage": 100, "external_use_native": false, "external_width": 1920, "internal_scale_percentage": 150, "recommended": true }

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : Display

DisplayRotationDefault

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DisplayRotationDefault

Supported on:

• Google Chrome OS (Google Chrome OS) since version 48

Supported features:

Can Be Recommended: No, Dynamic Policy Refresh: Yes, Per Profile: No

Description:

If this policy is set, each display is rotated to the specified orientation on every reboot, and the first time it is connected after the policy value has changed. Users may change the display rotation via the settings page after logging in, but their setting will be overridden by the policy value at the next reboot.

This policy applies to both the primary and all secondary displays.

If the policy is not set, the default value is 0 degrees and the user is free to change it. In this case, the default value is not reapplied at restart.

• 0 = Rotate screen by 0 degrees
• 1 = Rotate screen clockwise by 90 degrees
• 2 = Rotate screen by 180 degrees
• 3 = Rotate screen clockwise by 270 degrees

Example value:

0x00000001 (Windows)

Extensions

ExtensionInstallBlacklist

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ExtensionInstallBlacklist

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ExtensionInstallBlacklist

Mac/Linux preference name:

ExtensionInstallBlacklist

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to specify which extensions the users can NOT install. Extensions already installed will be disabled if blacklisted, without a way for the user to enable them. Once an extension disabled due to the blacklist is removed from it, it will automatically get re-enabled.

A blacklist value of '*' means all extensions are blacklisted unless they are explicitly listed in the whitelist.

If this policy is left not set the user can install any extension in Google Chrome.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\ExtensionInstallBlacklist\1 = "extension_id1" Software\Policies\Google\Chrome\ExtensionInstallBlacklist\2 = "extension_id2"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ExtensionInstallBlacklist\1 = "extension_id1" Software\Policies\Google\ChromeOS\ExtensionInstallBlacklist\2 = "extension_id2"

Android/Linux:

[ "extension_id1", "extension_id2" ]

Mac:

<array> <string>extension_id1</string> <string>extension_id2</string> </array>

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : Extensions

ExtensionInstallWhitelist

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ExtensionInstallWhitelist

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ExtensionInstallWhitelist

Mac/Linux preference name:

ExtensionInstallWhitelist

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to specify which extensions are not subject to the blacklist.

A blacklist value of * means all extensions are blacklisted and users can only install extensions listed in the whitelist.

By default, all extensions are whitelisted, but if all extensions have been blacklisted by policy, the whitelist can be used to override that policy.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\ExtensionInstallWhitelist\1 = "extension_id1" Software\Policies\Google\Chrome\ExtensionInstallWhitelist\2 = "extension_id2"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ExtensionInstallWhitelist\1 = "extension_id1" Software\Policies\Google\ChromeOS\ExtensionInstallWhitelist\2 = "extension_id2"

Android/Linux:

[ "extension_id1", "extension_id2" ]

Mac:

<array> <string>extension_id1</string> <string>extension_id2</string> </array>

ExtensionInstallForcelist

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ExtensionInstallForcelist

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ExtensionInstallForcelist

Mac/Linux preference name:

ExtensionInstallForcelist

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 9
• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies a list of apps and extensions that are installed silently, without user interaction, and which cannot be uninstalled nor disabled by the user. All permissions requested by the apps/extensions are granted implicitly, without user interaction, including any additional permissions requested by future versions of the app/extension. Furthermore, permissions are granted for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. (These two APIs are not available to apps/extensions that are not force-installed.)

This policy takes precedence over a potentially conflicting ExtensionInstallBlacklist policy. If an app or extension that previously had been force-installed is removed from this list, it is automatically uninstalled by Google Chrome.

For Windows instances that are not joined to a Microsoft® Active Directory® domain, forced installation is limited to apps and extensions listed in the Chrome Web Store.

Note that the source code of any extension may be altered by users via Developer Tools (potentially rendering the extension dysfunctional). If this is a concern, the DeveloperToolsDisabled policy should be set.

Each list item of the policy is a string that contains an extension ID and, optionally, an "update" URL separated by a semicolon (;). The extension ID is the 32-letter string found e.g. on chrome://extensions when in developer mode. The "update" URL, if specified, should point to an Update Manifest XML document as described at https://developer.chrome.com/extensions/autoupdate. By default, the Chrome Web Store's update URL is used (which currently is "https://clients2.google.com/service/update2/crx"). Note that the "update" URL set in this policy is only used for the initial installation; subsequent updates of the extension employ the update URL indicated in the extension's manifest. Note also that specifying the "update" URL explicitly was mandatory in Google Chrome versions up to and including 67.

For example, aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx installs the extension with id aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa from the standard Chrome Web Store "update" URL. For more information about hosting extensions, see: https://developer.chrome.com/extensions/hosting.

If this policy is left not set, no apps or extensions are installed automatically and the user can uninstall any app or extension in Google Chrome.

Note that this policy doesn't apply to incognito mode.

Note for Google Chrome OS devices supporting Android apps:

Android apps can be force-installed from the Google Admin console using Google Play. They do not use this policy.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\ExtensionInstallForcelist\1 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx" Software\Policies\Google\Chrome\ExtensionInstallForcelist\2 = "abcdefghijklmnopabcdefghijklmnop"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ExtensionInstallForcelist\1 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx" Software\Policies\Google\ChromeOS\ExtensionInstallForcelist\2 = "abcdefghijklmnopabcdefghijklmnop"

Android/Linux:

[ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx", "abcdefghijklmnopabcdefghijklmnop" ]

Mac:

<array> <string>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx</string> <string>abcdefghijklmnopabcdefghijklmnop</string> </array>

ExtensionInstallSources

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ExtensionInstallSources

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ExtensionInstallSources

Mac/Linux preference name:

ExtensionInstallSources

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 21
• Google Chrome OS (Google Chrome OS) since version 21

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to specify which URLs are allowed to install extensions, apps, and themes.

Starting in Google Chrome 21, it is more difficult to install extensions, apps, and user scripts from outside the Chrome Web Store. Previously, users could click on a link to a *.crx file, and Google Chrome would offer to install the file after a few warnings. After Google Chrome 21, such files must be downloaded and dragged onto the Google Chrome settings page. This setting allows specific URLs to have the old, easier installation flow.

Each item in this list is an extension-style match pattern (see https://developer.chrome.com/extensions/match_patterns). Users will be able to easily install items from any URL that matches an item in this list. Both the location of the *.crx file and the page where the download is started from (i.e. the referrer) must be allowed by these patterns.

ExtensionInstallBlacklist takes precedence over this policy. That is, an extension on the blacklist won't be installed, even if it happens from a site on this list.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\ExtensionInstallSources\1 = "https://corp.mycompany.com/*"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ExtensionInstallSources\1 = "https://corp.mycompany.com/*"

Android/Linux:

[ "https://corp.mycompany.com/*" ]

Mac:

<array> <string>https://corp.mycompany.com/*</string> </array>

ExtensionAllowedTypes

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ExtensionAllowedTypes

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ExtensionAllowedTypes

Mac/Linux preference name:

ExtensionAllowedTypes

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 25
• Google Chrome OS (Google Chrome OS) since version 25

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Controls which app/extension types are allowed to be installed and limits runtime access.

This setting white-lists the allowed types of extension/apps that can be installed in Google Chrome and which hosts they can interact with. The value is a list of strings, each of which should be one of the following: "extension", "theme", "user_script", "hosted_app", "legacy_packaged_app", "platform_app". See the Google Chrome extensions documentation for more information on these types.

Note that this policy also affects extensions and apps to be force-installed via ExtensionInstallForcelist.

If this setting is configured, extensions/apps which have a type that is not on the list will not be installed.

If this settings is left not-configured, no restrictions on the acceptable extension/app types are enforced.

Prior to version 75 using multiple comma separated extension IDs is not supported and will be skipped. The rest of the policy will continue to apply.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\ExtensionAllowedTypes\1 = "hosted_app"

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ExtensionAllowedTypes\1 = "hosted_app"

Android/Linux:

[ "hosted_app" ]

Mac:

<array> <string>hosted_app</string> </array>

ExtensionAllowInsecureUpdates

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ExtensionAllowInsecureUpdates

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ExtensionAllowInsecureUpdates

Mac/Linux preference name:

ExtensionAllowInsecureUpdates

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 73
• Google Chrome OS (Google Chrome OS) since version 73

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Google Chrome provides for the secure update and installation of extensions. However, the content of some extensions hosted outside of the Chrome Web Store may only be protected by insecure signing or hashing algorithms such as SHA1. When this policy is disabled, fresh installation of and updates to such extensions will not be permitted by Chrome (until the extension developers rebuild the extension with stronger algorithms). When this policy is enabled, installation and updates for such extensions will be permitted.

This will default to the enabled behavior when unset. Starting in Google Chrome 76, this will default to the disabled behavior when unset.

Starting in Google Chrome 78, this policy will be ignored and treated as disabled.

Example value:

0x00000000 (Windows), false (Linux), <false /> (Mac)

ExtensionSettings

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ExtensionSettings

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ExtensionSettings

Mac/Linux preference name:

ExtensionSettings

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 62
• Google Chrome OS (Google Chrome OS) since version 62

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Configures extension management settings for Google Chrome.

This policy controls multiple settings, including settings controlled by any existing extension-related policies. This policy will override any legacy policies if both are set.

This policy maps an extension ID or an update URL to its configuration. With an extension ID, configuration will be applied to the specified extension only. A default configuration can be set for the special ID "*", which will apply to all extensions that don't have a custom configuration set in this policy. With an update URL, configuration will be applied to all extensions with the exact update URL stated in manifest of this extension, as described at https://developer.chrome.com/extensions/autoupdate.

For Windows instances that are not joined to a Microsoft® Active Directory® domain, forced installation is limited to apps and extensions listed in the Chrome Web Store.

Schema:

{ "patternProperties": { "^[a-p]{32}(?:,[a-p]{32})*,?$": { "properties": { "allowed_permissions": { "$ref": "ListOfPermissions" }, "blocked_install_message": { "description": "text that will be displayed to the user in the chrome webstore if installation is blocked.", "type": "string" }, "blocked_permissions": { "id": "ListOfPermissions", "items": { "pattern": "^[a-z][a-zA-Z.]*$", "type": "string" }, "type": "array" }, "installation_mode": { "enum": [ "blocked", "allowed", "force_installed", "normal_installed", "removed" ], "type": "string" }, "minimum_version_required": { "pattern": "^[0-9]+([.][0-9]+)*$", "type": "string" }, "runtime_allowed_hosts": { "$ref": "ListOfUrlPatterns" }, "runtime_blocked_hosts": { "id": "ListOfUrlPatterns", "items": { "type": "string" }, "type": "array" }, "update_url": { "type": "string" } }, "type": "object" }, "^update_url:": { "properties": { "allowed_permissions": { "$ref": "ListOfPermissions" }, "blocked_permissions": { "$ref": "ListOfPermissions" }, "installation_mode": { "enum": [ "blocked", "allowed", "removed" ], "type": "string" } }, "type": "object" } }, "properties": { "*": { "properties": { "allowed_types": { "$ref": "ExtensionAllowedTypes" }, "blocked_install_message": { "type": "string" }, "blocked_permissions": { "$ref": "ListOfPermissions" }, "install_sources": { "$ref": "ExtensionInstallSources" }, "installation_mode": { "enum": [ "blocked", "allowed", "removed" ], "type": "string" }, "runtime_allowed_hosts": { "$ref": "ListOfUrlPatterns" }, "runtime_blocked_hosts": { "$ref": "ListOfUrlPatterns" } }, "type": "object" } }, "type": "object" }

Expanded schema description:

https://www.chromium.org/administrators/policy-list-3/extension-settings-full

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\ExtensionSettings = { "*": { "allowed_types": [ "hosted_app" ], "blocked_install_message": "Custom error message.", "blocked_permissions": [ "downloads", "bookmarks" ], "install_sources": [ "https://company-intranet/chromeapps" ], "installation_mode": "blocked", "runtime_allowed_hosts": [ "*://good.example.com" ], "runtime_blocked_hosts": [ "*://*.example.com" ] }, "abcdefghijklmnopabcdefghijklmnop": { "blocked_permissions": [ "history" ], "installation_mode": "allowed", "minimum_version_required": "1.0.1" }, "bcdefghijklmnopabcdefghijklmnopa": { "allowed_permissions": [ "downloads" ], "installation_mode": "force_installed", "runtime_allowed_hosts": [ "*://good.example.com" ], "runtime_blocked_hosts": [ "*://*.example.com" ], "update_url": "https://example.com/update_url" }, "cdefghijklmnopabcdefghijklmnopab": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "fghijklmnopabcdefghijklmnopabcde": { "blocked_install_message": "Custom removal message.", "installation_mode": "removed" }, "update_url:https://www.example.com/update.xml": { "allowed_permissions": [ "downloads" ], "blocked_permissions": [ "wallpaper" ], "installation_mode": "allowed" } }

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ExtensionSettings = { "*": { "allowed_types": [ "hosted_app" ], "blocked_install_message": "Custom error message.", "blocked_permissions": [ "downloads", "bookmarks" ], "install_sources": [ "https://company-intranet/chromeapps" ], "installation_mode": "blocked", "runtime_allowed_hosts": [ "*://good.example.com" ], "runtime_blocked_hosts": [ "*://*.example.com" ] }, "abcdefghijklmnopabcdefghijklmnop": { "blocked_permissions": [ "history" ], "installation_mode": "allowed", "minimum_version_required": "1.0.1" }, "bcdefghijklmnopabcdefghijklmnopa": { "allowed_permissions": [ "downloads" ], "installation_mode": "force_installed", "runtime_allowed_hosts": [ "*://good.example.com" ], "runtime_blocked_hosts": [ "*://*.example.com" ], "update_url": "https://example.com/update_url" }, "cdefghijklmnopabcdefghijklmnopab": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "fghijklmnopabcdefghijklmnopabcde": { "blocked_install_message": "Custom removal message.", "installation_mode": "removed" }, "update_url:https://www.example.com/update.xml": { "allowed_permissions": [ "downloads" ], "blocked_permissions": [ "wallpaper" ], "installation_mode": "allowed" } }

Android/Linux:

ExtensionSettings: { "*": { "allowed_types": [ "hosted_app" ], "blocked_install_message": "Custom error message.", "blocked_permissions": [ "downloads", "bookmarks" ], "install_sources": [ "https://company-intranet/chromeapps" ], "installation_mode": "blocked", "runtime_allowed_hosts": [ "*://good.example.com" ], "runtime_blocked_hosts": [ "*://*.example.com" ] }, "abcdefghijklmnopabcdefghijklmnop": { "blocked_permissions": [ "history" ], "installation_mode": "allowed", "minimum_version_required": "1.0.1" }, "bcdefghijklmnopabcdefghijklmnopa": { "allowed_permissions": [ "downloads" ], "installation_mode": "force_installed", "runtime_allowed_hosts": [ "*://good.example.com" ], "runtime_blocked_hosts": [ "*://*.example.com" ], "update_url": "https://example.com/update_url" }, "cdefghijklmnopabcdefghijklmnopab": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "fghijklmnopabcdefghijklmnopabcde": { "blocked_install_message": "Custom removal message.", "installation_mode": "removed" }, "update_url:https://www.example.com/update.xml": { "allowed_permissions": [ "downloads" ], "blocked_permissions": [ "wallpaper" ], "installation_mode": "allowed" } }

Mac:

<key>ExtensionSettings</key> <dict> <key>*</key> <dict> <key>allowed_types</key> <array> <string>hosted_app</string> </array> <key>blocked_install_message</key> <string>Custom error message.</string> <key>blocked_permissions</key> <array> <string>downloads</string> <string>bookmarks</string> </array> <key>install_sources</key> <array> <string>https://company-intranet/chromeapps</string> </array> <key>installation_mode</key> <string>blocked</string> <key>runtime_allowed_hosts</key> <array> <string>*://good.example.com</string> </array> <key>runtime_blocked_hosts</key> <array> <string>*://*.example.com</string> </array> </dict> <key>abcdefghijklmnopabcdefghijklmnop</key> <dict> <key>blocked_permissions</key> <array> <string>history</string> </array> <key>installation_mode</key> <string>allowed</string> <key>minimum_version_required</key> <string>1.0.1</string> </dict> <key>bcdefghijklmnopabcdefghijklmnopa</key> <dict> <key>allowed_permissions</key> <array> <string>downloads</string> </array> <key>installation_mode</key> <string>force_installed</string> <key>runtime_allowed_hosts</key> <array> <string>*://good.example.com</string> </array> <key>runtime_blocked_hosts</key> <array> <string>*://*.example.com</string> </array> <key>update_url</key> <string>https://example.com/update_url</string> </dict> <key>cdefghijklmnopabcdefghijklmnopab</key> <dict> <key>blocked_install_message</key> <string>Custom error message.</string> <key>installation_mode</key> <string>blocked</string> </dict> <key>defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd</key> <dict> <key>blocked_install_message</key> <string>Custom error message.</string> <key>installation_mode</key> <string>blocked</string> </dict> <key>fghijklmnopabcdefghijklmnopabcde</key> <dict> <key>blocked_install_message</key> <string>Custom removal message.</string> <key>installation_mode</key> <string>removed</string> </dict> <key>update_url:https://www.example.com/update.xml</key> <dict> <key>allowed_permissions</key> <array> <string>downloads</string> </array> <key>blocked_permissions</key> <array> <string>wallpaper</string> </array> <key>installation_mode</key> <string>allowed</string> </dict> </dict>

Google Assistant

VoiceInteractionContextEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\VoiceInteractionContextEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 74

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy gives Google Assistant permission to access screen context and send the info to server. If the policy is enabled, Google Assistant will be allowed to access screen context. If the policy is disabled, Google Assistant will not be allowed to access screen context. If not set, users can decide whether to allow Google Assistant to access screen context or not

Example value:

0x00000001 (Windows)

VoiceInteractionHotwordEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\VoiceInteractionHotwordEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 74

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy gives Google Assistant permission to listen for the voice activation phrase.

If the policy is enabled, Google Assistant would listen for the voice activation phrase. If the policy is disabled, Google Assistant would not listen for the voice activation phrase. If the policy is not set, users can decide whether to allow Google Assistant to listen for the voice activation phrase.

Example value:

0x00000001 (Windows)

Google Cast

EnableMediaRouter

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\EnableMediaRouter

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\EnableMediaRouter

Mac/Linux preference name:

EnableMediaRouter

Android restriction name:

EnableMediaRouter

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 52
• Google Chrome OS (Google Chrome OS) since version 52
• Google Chrome (Android) since version 52

Supported features:

Dynamic Policy Refresh: No, Per Profile: Yes

Description:

If this policy is set to true or is not set, Google Cast will be enabled, and users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon.

If this policy set to false, Google Cast will be disabled.

Example value:

0x00000001 (Windows), true (Linux), true (Android), <true /> (Mac)

ShowCastIconInToolbar

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\ShowCastIconInToolbar

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ShowCastIconInToolbar

Mac/Linux preference name:

ShowCastIconInToolbar

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 58
• Google Chrome OS (Google Chrome OS) since version 58

Supported features:

Dynamic Policy Refresh: No, Per Profile: Yes

Description:

If this policy is set to true, the Cast toolbar icon will always be shown on the toolbar or the overflow menu, and users will not be able to remove it.

If this policy is set to false or is not set, users will be able to pin or remove the icon via its contextual menu.

If the policy "EnableMediaRouter" is set to false, then this policy's value would have no effect, and the toolbar icon would not be shown.

Example value:

0x00000000 (Windows), false (Linux), <false /> (Mac)

Google Drive

DriveDisabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DriveDisabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 19

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Disables Google Drive syncing in the Google Chrome OS Files app when set to True. In that case, no data is uploaded to Google Drive.

If not set or set to False, then users will be able to transfer files to Google Drive.

Note for Google Chrome OS devices supporting Android apps:

This policy does not prevent the user from using the Android Google Drive app. If you want to prevent access to Google Drive, you should disallow installation of the Android Google Drive app as well.

Example value:

0x00000001 (Windows)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : Drive

DriveDisabledOverCellular

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DriveDisabledOverCellular

Supported on:

• Google Chrome OS (Google Chrome OS) since version 19

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Disables Google Drive syncing in the Google Chrome OS Files app when using a cellular connection when set to True. In that case, data is only synced to Google Drive when connected via WiFi or Ethernet.

If not set or set to False, then users will be able to transfer files to Google Drive via cellular connections.

Note for Google Chrome OS devices supporting Android apps:

This policy has no effect on the Android Google Drive app. If you want to prevent use of Google Drive over cellular connections, you should disallow installation of the Android Google Drive app.

Example value:

0x00000001 (Windows)

HTTP authentication

AuthSchemes

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\AuthSchemes

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\AuthSchemes

Mac/Linux preference name:

AuthSchemes

Android restriction name:

AuthSchemes

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 9
• Google Chrome (Android) since version 46
• Google Chrome OS (Google Chrome OS) since version 62

Supported features:

Dynamic Policy Refresh: No, Per Profile: No

Description:

Specifies which HTTP authentication schemes are supported by Google Chrome.

Possible values are 'basic', 'digest', 'ntlm' and 'negotiate'. Separate multiple values with commas.

If this policy is left not set, all four schemes will be used.

Example value:

"basic,digest,ntlm,negotiate"

DisableAuthNegotiateCnameLookup

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DisableAuthNegotiateCnameLookup

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DisableAuthNegotiateCnameLookup

Mac/Linux preference name:

DisableAuthNegotiateCnameLookup

Android restriction name:

DisableAuthNegotiateCnameLookup

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 9
• Google Chrome (Android) since version 46
• Google Chrome OS (Google Chrome OS) since version 62

Supported features:

Dynamic Policy Refresh: No, Per Profile: No

Description:

Specifies whether the generated Kerberos SPN is based on the canonical DNS name or the original name entered.

If you enable this setting, CNAME lookup will be skipped and the server name will be used as entered.

If you disable this setting or leave it not set, the canonical name of the server will be determined via CNAME lookup.

Example value:

0x00000000 (Windows), false (Linux), false (Android), <false /> (Mac)

EnableAuthNegotiatePort

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\EnableAuthNegotiatePort

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\EnableAuthNegotiatePort

Mac/Linux preference name:

EnableAuthNegotiatePort

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 9
• Google Chrome OS (Google Chrome OS) since version 62

Supported features:

Dynamic Policy Refresh: No, Per Profile: No

Description:

Specifies whether the generated Kerberos SPN should include a non-standard port.

If you enable this setting, and a non-standard port (i.e., a port other than 80 or 443) is entered, it will be included in the generated Kerberos SPN.

If you disable this setting or leave it not set, the generated Kerberos SPN will not include a port in any case.

Example value:

0x00000000 (Windows), false (Linux), <false /> (Mac)

AuthServerWhitelist

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\AuthServerWhitelist

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\AuthServerWhitelist

Mac/Linux preference name:

AuthServerWhitelist

Android restriction name:

AuthServerWhitelist

Android WebView restriction name:

com.android.browser:AuthServerWhitelist

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 9
• Google Chrome (Android) since version 46
• Android System WebView (Android) since version 49
• Google Chrome OS (Google Chrome OS) since version 62

Supported features:

Dynamic Policy Refresh: No, Per Profile: No

Description:

Specifies which servers should be whitelisted for integrated authentication. Integrated authentication is only enabled when Google Chrome receives an authentication challenge from a proxy or from a server which is in this permitted list.

Separate multiple server names with commas. Wildcards (*) are allowed.

If you leave this policy not set Google Chrome will try to detect if a server is on the Intranet and only then will it respond to IWA requests. If a server is detected as Internet then IWA requests from it will be ignored by Google Chrome.

Example value:

"*example.com,foobar.com,*baz"

AuthNegotiateDelegateWhitelist

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\AuthNegotiateDelegateWhitelist

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\AuthNegotiateDelegateWhitelist

Mac/Linux preference name:

AuthNegotiateDelegateWhitelist

Android restriction name:

AuthNegotiateDelegateWhitelist

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 9
• Google Chrome (Android) since version 46
• Google Chrome OS (Google Chrome OS) since version 62

Supported features:

Dynamic Policy Refresh: No, Per Profile: No

Description:

Servers that Google Chrome may delegate to.

Separate multiple server names with commas. Wildcards (*) are allowed.

If you leave this policy not set Google Chrome will not delegate user credentials even if a server is detected as Intranet.

Example value:

"foobar.example.com"

AuthNegotiateDelegateByKdcPolicy

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\AuthNegotiateDelegateByKdcPolicy

Mac/Linux preference name:

AuthNegotiateDelegateByKdcPolicy

Supported on:

• Google Chrome (Linux) since version 74
• Google Chrome (Mac) since version 74
• Google Chrome OS (Google Chrome OS) since version 74

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Controls whether approval by KDC policy is respected to decide whether to delegate Kerberos tickets.

If this policy is true, HTTP authentication respects approval by KDC policy, i.e. Chrome only delegates credentials if the KDC sets OK-AS-DELEGATE on a service ticket. Please see https://tools.ietf.org/html/rfc5896.html for more information. Service should also match 'AuthNegotiateDelegateWhitelist' policy.

If this policy is not set or set to false, KDC policy is ignored on supported platforms and 'AuthNegotiateDelegateWhitelist' policy only is respected.

On Windows KDC policy is always respected.

Example value:

0x00000001 (Windows), true (Linux), <true /> (Mac)

GSSAPILibraryName

Data type:

String

Mac/Linux preference name:

GSSAPILibraryName

Supported on:

• Google Chrome (Linux) since version 9

Supported features:

Dynamic Policy Refresh: No, Per Profile: No

Description:

Specifies which GSSAPI library to use for HTTP authentication. You can set either just a library name, or a full path.

If no setting is provided, Google Chrome will fall back to using a default library name.

Example value:

"libgssapi_krb5.so.2"

AuthAndroidNegotiateAccountType

Data type:

String

Android restriction name:

AuthAndroidNegotiateAccountType

Android WebView restriction name:

com.android.browser:AuthAndroidNegotiateAccountType

Supported on:

• Google Chrome (Android) since version 46
• Android System WebView (Android) since version 49

Supported features:

Dynamic Policy Refresh: No, Per Profile: No

Description:

Specifies the account type of the accounts provided by the Android authentication app that supports HTTP Negotiate authentication (e.g. Kerberos authentication). This information should be available from the supplier of the authentication app. For more details see https://goo.gl/hajyfN.

If no setting is provided, HTTP Negotiate authentication is disabled on Android.

Example value:

"com.example.spnego"

AllowCrossOriginAuthPrompt

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\AllowCrossOriginAuthPrompt

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\AllowCrossOriginAuthPrompt

Mac/Linux preference name:

AllowCrossOriginAuthPrompt

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 13
• Google Chrome OS (Google Chrome OS) since version 62

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Controls whether third-party sub-content on a page is allowed to pop-up an HTTP Basic Auth dialog box.

Typically this is disabled as a phishing defense. If this policy is not set, this is disabled and third-party sub-content will not be allowed to pop up a HTTP Basic Auth dialog box.

Example value:

0x00000000 (Windows), false (Linux), <false /> (Mac)

NtlmV2Enabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NtlmV2Enabled

Mac/Linux preference name:

NtlmV2Enabled

Android restriction name:

NtlmV2Enabled

Android WebView restriction name:

com.android.browser:NtlmV2Enabled

Supported on:

• Google Chrome (Linux) since version 63
• Google Chrome (Mac) since version 63
• Google Chrome OS (Google Chrome OS) since version 63
• Google Chrome (Android) since version 63
• Android System WebView (Android) since version 63

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Controls whether NTLMv2 is enabled.

All recent versions of Samba and Windows servers support NTLMv2. This should only be disabled for backwards compatibility and reduces the security of authentication.

If this policy is not set, the default is true and NTLMv2 is enabled.

Example value:

0x00000001 (Windows), true (Linux), true (Android), <true /> (Mac)

Kiosk settings

DeviceLocalAccounts

Data type:

List of strings

Supported on:

• Google Chrome OS (Google Chrome OS) since version 25

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the list of device-local accounts to be shown on the login screen.

Every list entry specifies an identifier, which is used internally to tell the different device-local accounts apart.

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : Kiosk

DeviceLocalAccountAutoLoginId

Data type:

String

Supported on:

• Google Chrome OS (Google Chrome OS) since version 26

Supported features:

Dynamic Policy Refresh: Yes

Description:

A device-local account to auto-login after a delay.

If this policy is set, the specified session will be automatically logged in after a period of time has elapsed at the login screen without user interaction. The device-local account must already be configured (see |DeviceLocalAccounts|).

If this policy is unset, there will be no auto-login.

DeviceLocalAccountAutoLoginDelay

Data type:

Integer

Supported on:

• Google Chrome OS (Google Chrome OS) since version 26

Supported features:

Dynamic Policy Refresh: Yes

Description:

The device-local account auto-login delay.

If the |DeviceLocalAccountAutoLoginId| policy is unset, this policy has no effect. Otherwise:

If this policy is set, it determines the amount of time without user activity that should elapse before automatically logging into the device-local account specified by the |DeviceLocalAccountAutoLoginId| policy.

If this policy is unset, 0 milliseconds will be used as the timeout.

This policy is specified in milliseconds.

DeviceLocalAccountAutoLoginBailoutEnabled

Data type:

Boolean

Supported on:

• Google Chrome OS (Google Chrome OS) since version 28

Supported features:

Dynamic Policy Refresh: Yes

Description:

Enable bailout keyboard shortcut for auto-login.

If this policy is unset or set to True and a device-local account is configured for zero-delay auto-login, Google Chrome OS will honor the keyboard shortcut Ctrl+Alt+S for bypassing auto-login and showing the login screen.

If this policy is set to False, zero-delay auto-login (if configured) cannot be bypassed.

DeviceLocalAccountPromptForNetworkWhenOffline

Data type:

Boolean

Supported on:

• Google Chrome OS (Google Chrome OS) since version 33

Supported features:

Dynamic Policy Refresh: Yes

Description:

Enable network configuration prompt when offline.

If this policy is unset or set to True and a device-local account is configured for zero-delay auto-login and the device does not have access to the Internet, Google Chrome OS will show a network configuration prompt.

If this policy is set to False, an error message will be displayed instead of the network configuration prompt.

AllowKioskAppControlChromeVersion

Data type:

Boolean

Supported on:

• Google Chrome OS (Google Chrome OS) since version 51

Supported features:

Dynamic Policy Refresh: Yes

Description:

Whether to allow the auto launched with zero delay kiosk app to control Google Chrome OS version.

This policy controls whether to allow the auto launched with zero delay kiosk app to control Google Chrome OS version by declaring a required_platform_version in its manifest and use it as the auto update target version prefix.

If the policy is set to true, the value of required_platform_version manifest key of the auto launched with zero delay kiosk app is used as auto update target version prefix.

If the policy is not configured or set to false, the required_platform_version manifest key is ignored and auto update proceeds as normal.

Warning: It is not recommended to delegate control of the Google Chrome OS version to a kiosk app as it may prevent the device from receiving software updates and critical security fixes. Delegating control of the Google Chrome OS version might leave users at risk.

Note for Google Chrome OS devices supporting Android apps:

If the kiosk app is an Android app, it will have no control over the Google Chrome OS version, even if this policy is set to True.

Legacy Browser Support

AlternativeBrowserPath

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\AlternativeBrowserPath

Mac/Linux preference name:

AlternativeBrowserPath

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 71

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls which command to use to open URLs in an alternative browser.

When this policy is left unset, a platform-specific default is used: Internet Explorer for Windows, or Safari for Mac OS X. On Linux, launching an alternative browser will fail when this is unset.

When this policy is set to one of ${ie}, ${firefox}, ${safari} or ${opera}, that browser will launch if it is installed. ${ie} is only available on Windows, and ${safari} is only available on Windows and Mac OS X.

When this policy is set to a file path, that file is used as an executable file.

Example value:

"${ie}"

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : BrowserSwitcher

AlternativeBrowserParameters

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\AlternativeBrowserParameters

Mac/Linux preference name:

AlternativeBrowserParameters

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 71

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls command-line parameters to launch to the alternative browser.

When this policy is left unset, only the URL is passed as a command-line parameters.

When this policy is set to a list of strings, each string is passed to the alternative browser as a separate command-line parameters. On Windows, the parameters are joined with spaces. On Mac OS X and Linux, a parameter may contain spaces, and still be treated as a single parameter.

If an element contains ${url}, it gets replaced with the URL of the page to open.

If no element contains ${url}, the URL is appended at the end of the command line.

Environment variables are expanded. On Windows, %ABC% is replaced with the value of the ABC environment variable. On Mac OS X and Linux, ${ABC} is replaced with the value of the ABC environment variable.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\AlternativeBrowserParameters\1 = "-foreground" Software\Policies\Google\Chrome\AlternativeBrowserParameters\2 = "-new-window" Software\Policies\Google\Chrome\AlternativeBrowserParameters\3 = "${url}" Software\Policies\Google\Chrome\AlternativeBrowserParameters\4 = "-profile" Software\Policies\Google\Chrome\AlternativeBrowserParameters\5 = "%HOME%\browser_profile"

Android/Linux:

[ "-foreground", "-new-window", "${url}", "-profile", "%HOME%\browser_profile" ]

Mac:

<array> <string>-foreground</string> <string>-new-window</string> <string>${url}</string> <string>-profile</string> <string>%HOME%\browser_profile</string> </array>

BrowserSwitcherChromePath

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherChromePath

Supported on:

• Google Chrome (Windows) since version 74

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls the command to use to open URLs in Google Chrome when switching from Internet Explorer.

If the 'Legacy Browser Support' add-in for Internet Explorer is not installed, this policy has no effect.

When this policy is left unset, Internet Explorer will auto-detect Google Chrome's own executable path when launching Google Chrome from Internet Explorer.

When this policy is set, it will be used to launch Google Chrome when launching Google Chrome from Internet Explorer.

This policy can be set to an executable file path, or ${chrome} to auto-detect Chrome's install location.

Example value:

"${chrome}"

BrowserSwitcherChromeParameters

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherChromeParameters

Supported on:

• Google Chrome (Windows) since version 74

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls command-line parameters for Chrome from Internet Explorer.

If the 'Legacy Browser Support' add-in for Internet Explorer is not installed, this policy has no effect.

When this policy is left unset, Internet Explorer only passes the URL to Chrome as a command-line parameter.

When this policy is set to a list of strings, the strings are joined with spaces and passed to Chrome as command-line parameters.

If an element contains ${url}, it gets replaced with the URL of the page to open.

If no element contains ${url}, the URL is appended at the end of the command line.

Environment variables are expanded. On Windows, %ABC% is replaced with the value of the ABC environment variable.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\BrowserSwitcherChromeParameters\1 = "--force-dark-mode"

BrowserSwitcherDelay

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherDelay

Mac/Linux preference name:

BrowserSwitcherDelay

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 74

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls how long to wait before launching an alternative browser, in milliseconds.

When this policy is left unset, or set to 0, navigating to a designated URL immediately opens it in an alternative browser.

When this policy is set to a number, Chrome shows a message for that many milliseconds, and then opens the alternative browser.

Example value:

0x00002710 (Windows), 10000 (Linux), 10000 (Mac)

BrowserSwitcherEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherEnabled

Mac/Linux preference name:

BrowserSwitcherEnabled

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 73

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls whether to enable Legacy Browser Support.

When this policy is left unset, or is set to false, Chrome will not attempt to launch designated URLs in an alternate browser.

When this policy is set to true, Chrome will attempt to launch some URLs in an alternate browser (such as Internet Explorer). This feature is configured using the policies in the Legacy Browser support group.

This feature is a replacement for the 'Legacy Browser Support' extension. Configuration from the extension will carry over to this feature, but it is strongly advised to use the Chrome policies instead. This ensures better compatibility in the future.

Example value:

0x00000001 (Windows), true (Linux), <true /> (Mac)

BrowserSwitcherExternalSitelistUrl

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherExternalSitelistUrl

Mac/Linux preference name:

BrowserSwitcherExternalSitelistUrl

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 72

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy is a URL, that points to an XML file in the same format as Internet Explorer's SiteList policy. This loads rules from an XML file, without sharing those rules with Internet Explorer.

When this policy is left unset, or not set to a valid URL, Google Chrome does not use it as a source of rules for switching browsers.

When this policy is set to a valid URL, Google Chrome downloads the site list from that URL, and applies the rules as if they had been configured with the BrowserSwitcherUrlList policy.

For more information on Internet Explorer's SiteList policy: https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode

Example value:

"http://example.com/sitelist.xml"

BrowserSwitcherExternalGreylistUrl

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherExternalGreylistUrl

Mac/Linux preference name:

BrowserSwitcherExternalGreylistUrl

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 77

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy is a URL, that points to an XML file in the same format as Internet Explorer's SiteList policy. This loads rules from an XML file, without sharing those rules with Internet Explorer.

The rules in this XML file apply in the same way as BrowserSwitcherUrlGreylist. That is, these rules prevent Google Chrome from opening the alternative browser, and also prevent the alternative browser from opening Google Chrome.

When this policy is left unset, or not set to a valid URL, Google Chrome does not use it as a source of rules that don't trigger a browser switch.

When this policy is set to a valid URL, Google Chrome downloads the site list from that URL, and applies the rules as if they had been configured with the BrowserSwitcherUrlGreylist policy.

For more information on Internet Explorer's SiteList policy: https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode

Example value:

"http://example.com/greylist.xml"

BrowserSwitcherKeepLastChromeTab

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherKeepLastChromeTab

Mac/Linux preference name:

BrowserSwitcherKeepLastChromeTab

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 74

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls whether to close Chrome completely when the last tab would switch to another browser.

When this policy is left unset, or is set to true, Chrome will keep at least one tab open, after switching to an alternate browser.

When this policy is set to false, Chrome will close the tab after switching to an alternate browser, even if it was the last tab. This will cause Chrome to exit completely.

Example value:

0x00000000 (Windows), false (Linux), <false /> (Mac)

BrowserSwitcherUrlList

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherUrlList

Mac/Linux preference name:

BrowserSwitcherUrlList

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 71

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls the list of websites to open in an alternative browser.

Note that elements can also be added to this list through the BrowserSwitcherUseIeSitelist and BrowserSwitcherExternalSitelistUrl policies.

When this policy is left unset, no websites are added to the list.

When this policy is set, each item is treated as a rule for something to open in an alternative browser. Google Chrome uses those rules when choosing if a URL should open in an alternative browser.

When the Internet Explorer add-in is present and enabled, Internet Explorer switches back to Google Chrome when the rules do not match.

If rules contradict eachother, Google Chrome uses the most specific rule.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\BrowserSwitcherUrlList\1 = "ie.com" Software\Policies\Google\Chrome\BrowserSwitcherUrlList\2 = "!open-in-chrome.ie.com" Software\Policies\Google\Chrome\BrowserSwitcherUrlList\3 = "foobar.com/ie-only/"

Android/Linux:

[ "ie.com", "!open-in-chrome.ie.com", "foobar.com/ie-only/" ]

Mac:

<array> <string>ie.com</string> <string>!open-in-chrome.ie.com</string> <string>foobar.com/ie-only/</string> </array>

BrowserSwitcherUrlGreylist

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist

Mac/Linux preference name:

BrowserSwitcherUrlGreylist

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 71

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls the list of websites that will never cause a browser switch.

Note that elements can also be added to this list through the BrowserSwitcherExternalGreylistUrl policy.

When this policy is left unset, no websites are added to the list.

When this policy is set, each item is treated as a rule, similar to the BrowserSwitcherUrlList policy. However, the logic is reversed: rules that match will not open an alternative browser.

Unlike BrowserSwitcherUrlList, rules apply to both directions. That is, when the Internet Explorer add-in is present and enabled, it also controls whether Internet Explorer should open these URLs in Google Chrome.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist\1 = "ie.com" Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist\2 = "!open-in-chrome.ie.com" Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist\3 = "foobar.com/ie-only/"

Android/Linux:

[ "ie.com", "!open-in-chrome.ie.com", "foobar.com/ie-only/" ]

Mac:

<array> <string>ie.com</string> <string>!open-in-chrome.ie.com</string> <string>foobar.com/ie-only/</string> </array>

BrowserSwitcherUseIeSitelist

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\BrowserSwitcherUseIeSitelist

Supported on:

• Google Chrome (Windows) since version 71

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls whether to load rules from Internet Explorer's SiteList policy.

When this policy is left unset, or set to false, Google Chrome does not use Internet Explorer's SiteList policy as a source of rules for switching browsers.

When this policy is set to true, Google Chrome reads Internet Explorer's SiteList to obtain the site list's URL. Google Chrome then downloads the site list from that URL, and applies the rules as if they had been configured with the BrowserSwitcherUrlList policy.

For more information on Internet Explorer's SiteList policy: https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode

Example value:

0x00000001 (Windows)

Linux container

VirtualMachinesAllowed

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\VirtualMachinesAllowed

Supported on:

• Google Chrome OS (Google Chrome OS) since version 66

Supported features:

Dynamic Policy Refresh: Yes

Description:

Allows you to control whether virtual machines are allowed to run on Chrome OS.

If the policy is set to True, the device is allowed to run virtual machines. If the policy is set to False, the device will not be allowed to run virtual machines. All three policies, VirtualMachinesAllowed, CrostiniAllowed, and DeviceUnaffiliatedCrostiniAllowed need to be true when they apply for Crostini to be allowed to run. When this policy is changed to False, it applies to starting new virtual machines but does not shut down virtual machines which are already running. When this policy is not set on a managed device, the device is not allowed to run virtual machines. Unmanaged devices are allowed to run virtual machines.

Example value:

0x00000001 (Windows)

CrostiniAllowed

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\CrostiniAllowed

Supported on:

• Google Chrome OS (Google Chrome OS) since version 70

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enable this user to run Crostini.

If the policy is set to false, Crostini is not enabled for the user. If set to true or left unset, Crostini is enabled for the user as long as other settings also allow it. All three policies, VirtualMachinesAllowed, CrostiniAllowed, and DeviceUnaffiliatedCrostiniAllowed need to be true when they apply for Crostini to be allowed to run. When this policy is changed to false, it applies to starting new Crostini containers but does not shut down containers which are already running.

Example value:

0x00000000 (Windows)

DeviceUnaffiliatedCrostiniAllowed

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceUnaffiliatedCrostiniAllowed

Supported on:

• Google Chrome OS (Google Chrome OS) since version 70

Supported features:

Dynamic Policy Refresh: Yes

Description:

If the policy is set to false, unaffiliated users will not be allowed to use Crostini.

If the policy is unset or set to true, all users are allowed to use Crostini as long as other settings also allow it. All three policies, VirtualMachinesAllowed, CrostiniAllowed, and DeviceUnaffiliatedCrostiniAllowed need to be true when they apply for Crostini to be allowed to run. When this policy is changed to false, it applies to starting new Crostini containers but does not shut down containers which are already running.

Example value:

0x00000000 (Windows)

CrostiniExportImportUIAllowed

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\CrostiniExportImportUIAllowed

Supported on:

• Google Chrome OS (Google Chrome OS) since version 74

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

If the policy is set to false, the export / import UI will not be available to users, however it is still possible to use 'lxc' commands directly in the virtual machine to export and import container images.

Example value:

0x00000000 (Windows)

Microsoft® Active Directory® management settings

DeviceMachinePasswordChangeRate

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceMachinePasswordChangeRate

Supported on:

• Google Chrome OS (Google Chrome OS) since version 66

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the rate (in days) at which a client changes their machine account password. The password is randomly generated by the client and not visible to the user.

Just like user passwords, machine passwords should be changed regularly. Disabling this policy or setting a high number of days can have a negative impact on security since it gives potential attackers more time to find the machine account password and use it.

If the policy is unset, the machine account password is changed every 30 days.

If the policy is set to 0, machine account password change is disabled.

Note that passwords might get older than the specified number of days if the client has been offline for a longer period of time.

Restrictions:

• Minimum:0
• Maximum:9999

Example value:

0x00000000 (Windows)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : ActiveDirectoryManagement

DeviceUserPolicyLoopbackProcessingMode

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceUserPolicyLoopbackProcessingMode

Supported on:

• Google Chrome OS (Google Chrome OS) since version 66

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies whether and how user policy from computer GPO is processed.

If the policy is set to 'Default' or if it is unset, user policy is read only from user GPOs (computer GPOs are ignored).

If the policy is set to 'Merge', user policy in user GPOs is merged with user policy in computer GPOs (computer GPOs take preference).

If the policy is set to 'Replace', user policy in user GPOs is replaced by user policy in computer GPOs (user GPOs are ignored).

• 0 = Default
• 1 = Merge
• 2 = Replace

Example value:

0x00000000 (Windows)

DeviceKerberosEncryptionTypes

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceKerberosEncryptionTypes

Supported on:

• Google Chrome OS (Google Chrome OS) since version 66

Supported features:

Dynamic Policy Refresh: Yes

Description:

Sets encryption types that are allowed when requesting Kerberos tickets from an Microsoft® Active Directory® server.

If the policy is set to 'All', both the AES encryption types 'aes256-cts-hmac-sha1-96' and 'aes128-cts-hmac-sha1-96' as well as the RC4 encryption type 'rc4-hmac' are allowed. AES encryption takes preference if the server supports both types. Note that RC4 is insecure and the server should be reconfigured if possible to support AES encryption.

If the policy is set to 'Strong' or if it is unset, only the AES encryption types are allowed.

If the policy is set to 'Legacy', only the RC4 encryption type is allowed. This option is insecure and should only be needed in very specific circumstances.

See also https://wiki.samba.org/index.php/Samba_4.6_Features_added/changed#Kerberos_client_encryption_types.

• 0 = All (insecure)
• 1 = Strong
• 2 = Legacy (insecure)

Example value:

0x00000001 (Windows)

DeviceGpoCacheLifetime

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceGpoCacheLifetime

Supported on:

• Google Chrome OS (Google Chrome OS) since version 73

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the lifetime (in hours) of the Group Policy Object (GPO) cache. Instead of re-downloading GPOs on every policy fetch, the system may reuse cached GPOs as long as their version does not change. This policy specifies the maximum duration for which cached GPOs may be reused before they are re-downloaded. Rebooting and logging out clears the cache.

If the policy is unset, cached GPOs may be reused for up to 25 hours.

If the policy is set to 0, GPO caching is turned off. Note that this increases server load since GPOs are re-downloaded on every policy fetch, even if they did not change.

Restrictions:

• Minimum:0
• Maximum:9999

Example value:

0x00000000 (Windows)

DeviceAuthDataCacheLifetime

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceAuthDataCacheLifetime

Supported on:

• Google Chrome OS (Google Chrome OS) since version 73

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the lifetime (in hours) of the authentication data cache. The cache is used to speed up sign-in. It contains general data (workgroup name etc.) about affiliated realms, i.e. realms trusted by the machine realm. No user-specific data and no data for unaffiliated realms is cached. Rebooting the device clears the cache.

If the policy is unset, cached authentication data may be reused for up to 73 hours.

If the policy is set to 0, authentication data caching is turned off. This can significantly slow down sign-in of affiliated users since realm-specific data has to be fetched on every sign-in.

Note that realm data is cached even for ephemeral users. The cache should be turned off if tracing the realm of ephemeral users should be prevented.

Restrictions:

• Minimum:0
• Maximum:9999

Example value:

0x00000000 (Windows)

Native Messaging

NativeMessagingBlacklist

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\NativeMessagingBlacklist

Mac/Linux preference name:

NativeMessagingBlacklist

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 34

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to specify which native messaging hosts that should not be loaded.

A blacklist value of '*' means all native messaging hosts are blacklisted unless they are explicitly listed in the whitelist.

If this policy is left not set Google Chrome will load all installed native messaging hosts.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\NativeMessagingBlacklist\1 = "com.native.messaging.host.name1" Software\Policies\Google\Chrome\NativeMessagingBlacklist\2 = "com.native.messaging.host.name2"

Android/Linux:

[ "com.native.messaging.host.name1", "com.native.messaging.host.name2" ]

Mac:

<array> <string>com.native.messaging.host.name1</string> <string>com.native.messaging.host.name2</string> </array>

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : NativeMessaging

NativeMessagingWhitelist

Data type:

List of strings

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\NativeMessagingWhitelist

Mac/Linux preference name:

NativeMessagingWhitelist

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 34

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Allows you to specify which native messaging hosts are not subject to the blacklist.

A blacklist value of * means all native messaging hosts are blacklisted and only native messaging hosts listed in the whitelist will be loaded.

By default, all native messaging hosts are whitelisted, but if all native messaging hosts have been blacklisted by policy, the whitelist can be used to override that policy.

Example value:

Windows (Windows clients):

Software\Policies\Google\Chrome\NativeMessagingWhitelist\1 = "com.native.messaging.host.name1" Software\Policies\Google\Chrome\NativeMessagingWhitelist\2 = "com.native.messaging.host.name2"

Android/Linux:

[ "com.native.messaging.host.name1", "com.native.messaging.host.name2" ]

Mac:

<array> <string>com.native.messaging.host.name1</string> <string>com.native.messaging.host.name2</string> </array>

NativeMessagingUserLevelHosts

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\NativeMessagingUserLevelHosts

Mac/Linux preference name:

NativeMessagingUserLevelHosts

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 34

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enables user-level installation of Native Messaging hosts.

If this setting is enabled then Google Chrome allows usage of Native Messaging hosts installed on user level.

If this setting is disabled then Google Chrome will only use Native Messaging hosts installed on system level.

If this setting is left not set Google Chrome will allow usage of user-level Native Messaging hosts.

Example value:

0x00000000 (Windows), false (Linux), <false /> (Mac)

Network File Shares settings

NetworkFileSharesAllowed

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NetworkFileSharesAllowed

Supported on:

• Google Chrome OS (Google Chrome OS) since version 70

Supported features:

Dynamic Policy Refresh: No, Per Profile: Yes

Description:

This policy controls whether the Network File Shares feature for Google Chrome OS is allowed for a user.

When this policy is not configured or set to True, users will be able to use Network File Shares.

When this policy is set to False, users will be unable to use Network File Shares.

Example value:

0x00000001 (Windows)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : NetworkFileShares

NetBiosShareDiscoveryEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NetBiosShareDiscoveryEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 70

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

This policy controls whether the Network File Shares feature for Google Chrome OS should use the NetBIOS Name Query Request protocol to discover shares on the network. When this policy is set to True, share discovery will use the NetBIOS Name Query Request protocol protocol to discover shares on the network. When this policy is set to False, share discovery will not use the NetBIOS Name Query Request protocol protocol to discover shares. If the policy is left not set, the default is disabled for enterprise-managed users and enabled for non-managed users.

Example value:

0x00000001 (Windows)

NTLMShareAuthenticationEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NTLMShareAuthenticationEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 71

Supported features:

Dynamic Policy Refresh: No, Per Profile: Yes

Description:

This policy controls whether the Network File Shares feature for Google Chrome OS will use NTLM for authentication.

When this policy is set to True, NTLM will be used for authentication to SMB shares if necessary. When this policy is set to False, NTLM authentication to SMB shares will be disabled.

If the policy is left not set, the default is disabled for enterprise-managed users and enabled for non-managed users.

Example value:

0x00000001 (Windows)

NetworkFileSharesPreconfiguredShares

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NetworkFileSharesPreconfiguredShares

Supported on:

• Google Chrome OS (Google Chrome OS) since version 71

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies a list of preconfigued network file shares.

Each list item of the policy is an object with two members: "share_url" and "mode". "share_url" should be the URL of the share and "mode" should be either "drop_down" or "pre_mount". "drop_down" mode indicates that "share_url" will be added to the share discovery drop down. "pre_mount" mode indicates that "share_url" will be mounted.

Schema:

{ "items": { "properties": { "mode": { "enum": [ "drop_down", "pre_mount" ], "type": "string" }, "share_url": { "type": "string" } }, "required": [ "share_url", "mode" ], "type": "object" }, "type": "array" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\NetworkFileSharesPreconfiguredShares = [ { "mode": "drop_down", "share_url": "smb://server/share" }, { "mode": "drop_down", "share_url": "\\\\server\\share" } ]

Network settings

DeviceOpenNetworkConfiguration

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceOpenNetworkConfiguration

Supported on:

• Google Chrome OS (Google Chrome OS) since version 16

Supported features:

Dynamic Policy Refresh: Yes

Description:

Allows pushing network configuration to be applied for all users of a Google Chrome OS device. The network configuration is a JSON-formatted string as defined by the Open Network Configuration format.

Note for Google Chrome OS devices supporting Android apps:

Android apps can use the network configurations and CA certificates set via this policy, but do not have access to some configuration options.

Expanded schema description:

https://chromium.googlesource.com/chromium/src/+/master/components/onc/docs/onc_spec.md

Example value:

"{ "NetworkConfigurations": [ { "GUID": "{4b224dfd-6849-7a63-5e394343244ae9c9}", "Name": "my WiFi", "Type": "WiFi", "WiFi": { "SSID": "my WiFi", "HiddenSSID": false, "Security": "None", "AutoConnect": true } } ] }"

DeviceDataRoamingEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceDataRoamingEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 12

Supported features:

Dynamic Policy Refresh: Yes

Description:

Determines whether data roaming should be enabled for the device. If set to true, data roaming is allowed. If left unconfigured or set to false, data roaming will be not available.

Example value:

0x00000001 (Windows)

NetworkThrottlingEnabled

Data type:

Dictionary

Supported on:

• Google Chrome OS (Google Chrome OS) since version 56

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Allows enabling or disabling network throttling. This applies to all users, and to all interfaces on the device. Once set, the throttling persists until the policy is changed to disable it.

If set to false, there is no throttling. If set to true, the system is throttled to achieve the provided upload and download rates (in kbits/s).

Schema:

{ "properties": { "download_rate_kbits": { "description": "Desired download rate in kbits/s.", "type": "integer" }, "enabled": { "description": "A boolean flag indicating if throttling is enabled.", "type": "boolean" }, "upload_rate_kbits": { "description": "Desired upload rate in kbits/s.", "type": "integer" } }, "required": [ "enabled", "upload_rate_kbits", "download_rate_kbits" ], "type": "object" }

DeviceHostnameTemplate

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceHostnameTemplate

Supported on:

• Google Chrome OS (Google Chrome OS) since version 65

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Determine the hostname of the device used in DHCP requests.

If this policy is set to a non empty string, that string will be used as the device hostname during DHCP request.

The string can contain variables ${ASSET_ID}, ${SERIAL_NUM}, ${MAC_ADDR}, ${MACHINE_NAME} that would be replaced with values on the device before using as a hostname. Resulting substitution should be a valid hostname (per RFC 1035, section 3.1).

If this policy is not set, or the value after substitution is not a valid hostname, no hostname will be set in DHCP request.

Example value:

"chromebook-${ASSET_ID}"

DeviceWiFiFastTransitionEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceWiFiFastTransitionEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 72

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Allows enabling or disabling Fast Transition. This applies to all users, and to all interfaces on the device. In order for Fast Transition to be used, both this setting and the per-network ONC property need to be enabled. Once set, Fast Transition persists until the policy is changed to disable it.

If this policy is not set or set to false, Fast Transition is not used. If set to true, Fast Transition is used when the wireless access point supports it.

Example value:

0x00000001 (Windows)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : WiFi

DeviceWiFiAllowed

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceWiFiAllowed

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

If the policy is set to false, Google Chrome OS will disable WiFi and users cannot enable it back. If the policy is set to true or left unset, users will be able to enable or disable WiFi as they wish.

Example value:

0x00000001 (Windows)

DeviceDockMacAddressSource

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceDockMacAddressSource

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Configures which MAC (media access control) address will be used when a dock is connected to the device.

When a dock is connected to some device models, the device's designated dock MAC address is used to identify the device on Ethernet by default. This policy allows the administrator to change the source of the MAC address while docked.

If 'DeviceDockMacAddress' is selected or the policy is left unset, the device's designated dock MAC address will be used.

If 'DeviceNicMacAddress' is selected, the device's NIC (network interface controller) MAC address will be used.

If 'DockNicMacAddress' is selected, the dock's NIC MAC address will be used.

This setting can not be changed by the user.

• 1 = Device's designated dock MAC address
• 2 = Device's built-in NIC MAC address
• 3 = Dock's built-in NIC MAC address

Example value:

0x00000001 (Windows)

Other

UsbDetachableWhitelist

Data type:

List of strings

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\UsbDetachableWhitelist

Supported on:

• Google Chrome OS (Google Chrome OS) since version 51

Supported features:

Dynamic Policy Refresh: No

Description:

Defines the list of USB devices that are allowed to be detached from their kernel driver in order to be used through the chrome.usb API directly inside a web application. Entries are pairs of USB Vendor Identifier and Product Identifier to identify a specific hardware.

If this policy is not configured, the list of a detachable USB devices is empty.

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\UsbDetachableWhitelist\1 = "{'vendor_id': 1027, 'product_id': 24577}" Software\Policies\Google\ChromeOS\UsbDetachableWhitelist\2 = "{'vendor_id': 16700, 'product_id': 8453}"

DeviceAllowBluetooth

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceAllowBluetooth

Supported on:

• Google Chrome OS (Google Chrome OS) since version 52

Supported features:

Dynamic Policy Refresh: No

Description:

If this policy is set to false, Google Chrome OS will disable Bluetooth and the user cannot enable it back.

If this policy is set to true or left unset, the user will be able to enable or disable Bluetooth as they wish.

If this policy is set, the user cannot change or override it.

After enabling Bluetooth, the user must log out and log back in for the changes to take effect (no need for this when disabling Bluetooth).

Example value:

0x00000001 (Windows)

TPMFirmwareUpdateSettings

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\TPMFirmwareUpdateSettings

Supported on:

• Google Chrome OS (Google Chrome OS) since version 63

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Configures availability and behavior of TPM firmware update functionality.

Individual settings can be specified in JSON properties:

allow-user-initiated-powerwash: If set to true, users will be able to trigger the powerwash flow to install a TPM firmware update.

allow-user-initiated-preserve-device-state: If set to true, users will be able to invoke the TPM firmware update flow that preserves device-wide state (including enterprise enrollment), but loses user data. This update flow is available starting from version 68.

auto-update-mode: Controls how automatic TPM firmware updates are enforced for vulnerable TPM firmware. All flows preserve local device state. If set to 1 or left not set, TPM firmware updates are not enforced. If set to 2, TPM firmware will be updated at the next reboot after user acknowledges the update. If set to 3, TPM firmware will be updated at the next reboot. If set to 4, TPM firmware will be updated after enrollment, before user sign-in. This option is available starting from version 74.

If the policy is not set, TPM firmware update functionality will not be available.

Schema:

{ "properties": { "allow-user-initiated-powerwash": { "type": "boolean" }, "allow-user-initiated-preserve-device-state": { "type": "boolean" }, "auto-update-mode": { "enum": [ 1, 2, 3, 4 ], "type": "integer" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\TPMFirmwareUpdateSettings = { "allow-user-initiated-powerwash": true, "allow-user-initiated-preserve-device-state": true, "auto-update-mode": 1 }

DevicePolicyRefreshRate

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DevicePolicyRefreshRate

Supported on:

• Google Chrome OS (Google Chrome OS) since version 11

Supported features:

Dynamic Policy Refresh: Yes

Description:

Specifies the period in milliseconds at which the device management service is queried for device policy information.

Setting this policy overrides the default value of 3 hours. Valid values for this policy are in the range from 1800000 (30 minutes) to 86400000 (1 day). Any values not in this range will be clamped to the respective boundary.

Leaving this policy not set will make Google Chrome OS use the default value of 3 hours.

Note that if the platform supports policy notifications, the refresh delay will be set to 24 hours (ignoring all defaults and the value of this policy) because it is expected that policy notifications will force a refresh automatically whenever policy changes, making more frequent refreshes unnecessary.

Example value:

0x0036ee80 (Windows)

DeviceBlockDevmode

Data type:

Boolean

Supported on:

• Google Chrome OS (Google Chrome OS) since version 37

Supported features:

Dynamic Policy Refresh: Yes

Description:

Block developer mode.

If this policy is set to True, Google Chrome OS will prevent the device from booting into developer mode. The system will refuse to boot and show an error screen when the developer switch is turned on.

If this policy is unset or set to False, developer mode will remain available for the device.

Note for Google Chrome OS devices supporting Android apps:

This policy controls Google Chrome OS developer mode only. If you want to prevent access to Android Developer Options, you need to set the DeveloperToolsDisabled policy.

DeviceAllowRedeemChromeOsRegistrationOffers

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceAllowRedeemChromeOsRegistrationOffers

Supported on:

• Google Chrome OS (Google Chrome OS) since version 26

Supported features:

Dynamic Policy Refresh: Yes

Description:

IT admins for enterprise devices can use this flag to control whether to allow users to redeem offers through Chrome OS Registration.

If this policy is set to true or left not set, users will be able to redeem offers through Chrome OS Registration.

If this policy is set to false, user will not be able to redeem offers.

Example value:

0x00000001 (Windows)

DeviceQuirksDownloadEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceQuirksDownloadEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 51

Supported features:

Dynamic Policy Refresh: Yes

Description:

The Quirks Server provides hardware-specific configuration files, like ICC display profiles to adjust monitor calibration.

When this policy is set to false, the device will not attempt to contact the Quirks Server to download configuration files.

If this policy is true or not configured then Google Chrome OS will automatically contact the Quirks Server and download configuration files, if available, and store them on the device. Such files might, for example, be used to improve display quality of attached monitors.

Example value:

0x00000001 (Windows)

ExtensionCacheSize

Data type:

Integer

Supported on:

• Google Chrome OS (Google Chrome OS) since version 43

Supported features:

Dynamic Policy Refresh: No

Description:

Google Chrome OS caches Apps and Extensions for installation by multiple users of a single device to avoid re-downloading them for each user. If this policy is not configured or the value is lower than 1 MB, Google Chrome OS will use the default cache size.

Note for Google Chrome OS devices supporting Android apps:

The cache is not used for Android apps. If multiple users install the same Android app, it will be downloaded anew for each user.

DeviceOffHours

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceOffHours

Supported on:

• Google Chrome OS (Google Chrome OS) since version 62

Supported features:

Dynamic Policy Refresh: Yes

Description:

If "OffHours" policy is set, then the specified device policies are ignored (use the default settings of these policies) during the defined time intervals. Device policies are re-applied by Chrome on every event when "OffHours" period starts or ends. User will be notified and forced to sign out when "OffHours" time end and device policy settings are changed (e.g. when user is logged in not with an allowed account).

Schema:

{ "properties": { "ignored_policy_proto_tags": { "items": { "type": "integer" }, "type": "array" }, "intervals": { "items": { "id": "WeeklyTimeIntervals", "properties": { "end": { "$ref": "WeeklyTime" }, "start": { "id": "WeeklyTime", "properties": { "day_of_week": { "enum": [ "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY" ], "id": "WeekDay", "type": "string" }, "time": { "type": "integer" } }, "type": "object" } }, "type": "object" }, "type": "array" }, "timezone": { "type": "string" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DeviceOffHours = { "ignored_policy_proto_tags": [ 3, 8 ], "intervals": [ { "end": { "day_of_week": "MONDAY", "time": 21720000 }, "start": { "day_of_week": "MONDAY", "time": 12840000 } }, { "end": { "day_of_week": "FRIDAY", "time": 57600000 }, "start": { "day_of_week": "FRIDAY", "time": 38640000 } } ], "timezone": "GMT" }

Password manager

PasswordManagerEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\PasswordManagerEnabled

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PasswordManagerEnabled

Mac/Linux preference name:

PasswordManagerEnabled

Android restriction name:

PasswordManagerEnabled

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 30

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

If this setting is enabled, users can have Google Chrome memorize passwords and provide them automatically the next time they log in to a site.

If this settings is disabled, users cannot save new passwords but they may still use passwords that have been saved previously.

If this policy is enabled or disabled, users cannot change or override it in Google Chrome. If this policy is unset, password saving is allowed (but can be turned off by the user).

Note for Google Chrome OS devices supporting Android apps:

This policy has no effect on Android apps.

Example value:

0x00000001 (Windows), true (Linux), true (Android), <true /> (Mac)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : PasswordManager

PluginVm

PluginVmAllowed

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PluginVmAllowed

Supported on:

• Google Chrome OS (Google Chrome OS) since version 72

Supported features:

Dynamic Policy Refresh: Yes

Description:

Enable this device to run PluginVm.

If the policy is set to false or left unset, PluginVm is not enabled for the device. If set to true, PluginVm is enabled for the device as long as other settings also allow it. PluginVmAllowed needs to be true, PluginVmLicenseKey and PluginVmImage need to be set for PluginVm to be allowed to run.

Example value:

0x00000001 (Windows)

Policy atomic group:

This policy is part of the following atomic group (only policies from the highest priority source present in the group are applied) : PluginVm

PluginVmLicenseKey

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PluginVmLicenseKey

Supported on:

• Google Chrome OS (Google Chrome OS) since version 73

Supported features:

Dynamic Policy Refresh: Yes

Description:

This policy specifies PluginVm license key for this device.

Example value:

"LICENSE_KEY"

PluginVmImage

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PluginVmImage

Supported on:

• Google Chrome OS (Google Chrome OS) since version 72

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

This policy specifies the PluginVm image for a user. The policy is set by specifying the URL from which the device can download the image and a SHA-256 hash used to verify the integrity of the download.

The policy should be specified as a string that expresses the URL and hash in the JSON format.

Schema:

{ "properties": { "hash": { "description": "The SHA-256 hash of the PluginVm image.", "type": "string" }, "url": { "description": "The URL from which the PluginVm image can be downloaded.", "type": "string" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\PluginVmImage = { "hash": "842841a4c75a55ad050d686f4ea5f77e83ae059877fe9b6946aa63d3d057ed32", "url": "https://example.com/plugin_vm_image" }

Power and shutdown

DeviceLoginScreenPowerManagement

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceLoginScreenPowerManagement

Supported on:

• Google Chrome OS (Google Chrome OS) since version 30

Supported features:

Dynamic Policy Refresh: Yes

Description:

Configure power management on the login screen in Google Chrome OS.

This policy lets you configure how Google Chrome OS behaves when there is no user activity for some amount of time while the login screen is being shown. The policy controls multiple settings. For their individual semantics and value ranges, see the corresponding policies that control power management within a session. The only deviations from these policies are: * The actions to take on idle or lid close cannot be to end the session. * The default action taken on idle when running on AC power is to shut down.

If a setting is left unspecified, a default value is used.

If this policy is unset, defaults are used for all settings.

Schema:

{ "properties": { "AC": { "description": "Power management settings applicable only when running on AC power", "id": "DeviceLoginScreenPowerSettings", "properties": { "Delays": { "properties": { "Idle": { "description": "The length of time without user input after which the idle action is taken, in milliseconds", "minimum": 0, "type": "integer" }, "ScreenDim": { "description": "The length of time without user input after which the screen is dimmed, in milliseconds", "minimum": 0, "type": "integer" }, "ScreenOff": { "description": "The length of time without user input after which the screen is turned off, in milliseconds", "minimum": 0, "type": "integer" } }, "type": "object" }, "IdleAction": { "description": "Action to take when the idle delay is reached", "enum": [ "Suspend", "Shutdown", "DoNothing" ], "type": "string" } }, "type": "object" }, "Battery": { "$ref": "DeviceLoginScreenPowerSettings", "description": "Power management settings applicable only when running on battery power" }, "LidCloseAction": { "description": "Action to take when the lid is closed", "enum": [ "Suspend", "Shutdown", "DoNothing" ], "type": "string" }, "UserActivityScreenDimDelayScale": { "description": "Percentage by which the screen dim delay is scaled when user activity is observed while the screen is dimmed or soon after the screen has been turned off", "minimum": 100, "type": "integer" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DeviceLoginScreenPowerManagement = { "AC": { "IdleAction": "DoNothing" }, "Battery": { "Delays": { "Idle": 30000, "ScreenDim": 10000, "ScreenOff": 20000 }, "IdleAction": "DoNothing" }, "LidCloseAction": "Suspend", "UserActivityScreenDimDelayScale": 110 }

UptimeLimit

Data type:

Integer

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Dynamic Policy Refresh: Yes

Description:

Limit the device uptime by scheduling automatic reboots.

When this policy is set, it specifies the length of device uptime after which an automatic reboot is scheduled.

When this policy is not set, the device uptime is not limited.

If you set this policy, users cannot change or override it.

An automatic reboot is scheduled at the selected time but may be delayed on the device by up to 24 hours if a user is currently using the device.

Note: Currently, automatic reboots are only enabled while the login screen is being shown or a kiosk app session is in progress. This will change in the future and the policy will always apply, regardless of whether a session of any particular type is in progress or not.

The policy value should be specified in seconds. Values are clamped to be at least 3600 (one hour).

DeviceRebootOnShutdown

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceRebootOnShutdown

Supported on:

• Google Chrome OS (Google Chrome OS) since version 41

Supported features:

Dynamic Policy Refresh: Yes

Description:

If this policy is set to false or not configured, Google Chrome OS will allow the user to shut down the device. If this policy is set to true, Google Chrome OS will trigger a reboot when the user shuts down the device. Google Chrome OS replaces all occurrences of shutdown buttons in the UI by reboot buttons. If the user shuts down the device using the power button, it will not automatically reboot, even if the policy is enabled.

Example value:

0x00000001 (Windows)

Power management

ScreenDimDelayAC (deprecated)

ScreenOffDelayAC (deprecated)

ScreenLockDelayAC (deprecated)

IdleWarningDelayAC (deprecated)

IdleDelayAC (deprecated)

ScreenDimDelayBattery (deprecated)

ScreenOffDelayBattery (deprecated)

ScreenLockDelayBattery (deprecated)

IdleWarningDelayBattery (deprecated)

IdleDelayBattery (deprecated)

IdleAction (deprecated)

IdleActionAC (deprecated)

IdleActionBattery (deprecated)

LidCloseAction

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\LidCloseAction

Supported on:

• Google Chrome OS (Google Chrome OS) since version 26

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

When this policy is set, it specifies the action that Google Chrome OS takes when the user closes the device's lid.

When this policy is unset, the default action is taken, which is suspend.

If the action is suspend, Google Chrome OS can separately be configured to either lock or not lock the screen before suspending.

• 0 = Suspend
• 1 = Log the user out
• 2 = Shut down
• 3 = Do nothing

Example value:

0x00000000 (Windows)

PowerManagementUsesAudioActivity

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PowerManagementUsesAudioActivity

Supported on:

• Google Chrome OS (Google Chrome OS) since version 26

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

If this policy is set to True or is unset, the user is not considered to be idle while audio is playing. This prevents the idle timeout from being reached and the idle action from being taken. However, screen dimming, screen off and screen lock will be performed after the configured timeouts, irrespective of audio activity.

If this policy is set to False, audio activity does not prevent the user from being considered idle.

Example value:

0x00000001 (Windows)

PowerManagementUsesVideoActivity

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PowerManagementUsesVideoActivity

Supported on:

• Google Chrome OS (Google Chrome OS) since version 26

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

If this policy is set to True or is unset, the user is not considered to be idle while video is playing. This prevents the idle delay, screen dim delay, screen off delay and screen lock delay from being reached and the corresponding actions from being taken.

If this policy is set to False, video activity does not prevent the user from being considered idle.

Note for Google Chrome OS devices supporting Android apps:

Video playing in Android apps is not taken into consideration, even if this policy is set to True.

Example value:

0x00000001 (Windows)

PresentationScreenDimDelayScale

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PresentationScreenDimDelayScale

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies the percentage by which the screen dim delay is scaled when the device is in presentation mode.

If this policy is set, it specifies the percentage by which the screen dim delay is scaled when the device is in presentation mode. When the screen dim delay is scaled, the screen off, screen lock and idle delays get adjusted to maintain the same distances from the screen dim delay as originally configured.

If this policy is unset, a default scale factor is used.

This policy only takes effect if the PowerSmartDimEnabled is disabled. Otherwise, this policy is ignored because the screen dim delay is deteremined by a machine-learning model.

The scale factor must be 100% or more. Values that would make the screen dim delay in presentation mode shorter than the regular screen dim delay are not allowed.

Example value:

0x000000c8 (Windows)

AllowWakeLocks

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\AllowWakeLocks

Supported on:

• Google Chrome OS (Google Chrome OS) since version 71

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies whether wake locks are allowed. Wake locks can be requested by extensions via the power management extension API and by ARC apps.

If this policy is set to true or left not set, wake locks will be honored for power management.

If this policy is set to false, wake lock requests will get ignored.

Example value:

0x00000000 (Windows)

AllowScreenWakeLocks

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\AllowScreenWakeLocks

Supported on:

• Google Chrome OS (Google Chrome OS) since version 28

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies whether screen wake locks are allowed. Screen wake locks can be requested by extensions via the power management extension API and by ARC apps.

If this policy is set to true or left not set, screen wake locks will be honored for power management, unless AllowWakeLocks is set to false.

If this policy is set to false, screen wake lock requests will be demoted to system wake lock requests.

Example value:

0x00000000 (Windows)

UserActivityScreenDimDelayScale

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\UserActivityScreenDimDelayScale

Supported on:

• Google Chrome OS (Google Chrome OS) since version 29

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies the percentage by which the screen dim delay is scaled when user activity is observed while the screen is dimmed or soon after the screen has been turned off.

If this policy is set, it specifies the percentage by which the screen dim delay is scaled when user activity is observed while the screen is dimmed or soon after the screen has been turned off. When the dim delay is scaled, the screen off, screen lock and idle delays get adjusted to maintain the same distances from the screen dim delay as originally configured.

If this policy is unset, a default scale factor is used.

This policy only takes effect if the PowerSmartDimEnabled policy is disabled. Otherwise, this policy is ignored because the screen dim delay is deteremined by a machine-learning model.

The scale factor must be 100% or more.

Example value:

0x000000c8 (Windows)

WaitForInitialUserActivity

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\WaitForInitialUserActivity

Supported on:

• Google Chrome OS (Google Chrome OS) since version 32

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies whether power management delays and the session length limit should only start running after the first user activity has been observed in a session.

If this policy is set to True, power management delays and the session length limit do not start running until after the first user activity has been observed in a session.

If this policy is set to False or left unset, power management delays and the session length limit start running immediately on session start.

Example value:

0x00000001 (Windows)

PowerManagementIdleSettings

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PowerManagementIdleSettings

Supported on:

• Google Chrome OS (Google Chrome OS) since version 35

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

This policy controls multiple settings for the power management strategy when the user becomes idle.

There are four types of action: * The screen will be dimmed if the user remains idle for the time specified by |ScreenDim|. * The screen will be turned off if the user remains idle for the time specified by |ScreenOff|. * A warning dialog will be shown if the user remains idle for the time specified by |IdleWarning|, telling the user that the idle action is about to be taken. The warning message is only shown if the idle action is to logout or shut down. * The action specified by |IdleAction| will be taken if the user remains idle for the time specified by |Idle|.

For each of above actions, the delay should be specified in milliseconds, and needs to be set to a value greater than zero to trigger the corresponding action. In case the delay is set to zero, Google Chrome OS will not take the corresponding action.

For each of the above delays, when the length of time is unset, a default value will be used.

Note that |ScreenDim| values will be clamped to be less than or equal to |ScreenOff|, |ScreenOff| and |IdleWarning| will be clamped to be less than or equal to |Idle|.

|IdleAction| can be one of four possible actions: * |Suspend| * |Logout| * |Shutdown| * |DoNothing|

When the |IdleAction| is unset, the default action is taken, which is suspend.

There are also separate settings for AC power and battery.

Schema:

{ "properties": { "AC": { "description": "Delays and actions to take when the device is idle and running on AC power", "id": "PowerManagementDelays", "properties": { "Delays": { "properties": { "Idle": { "description": "The length of time without user input after which the idle action is taken, in milliseconds", "minimum": 0, "type": "integer" }, "IdleWarning": { "description": "The length of time without user input after which a warning dialog is shown, in milliseconds", "minimum": 0, "type": "integer" }, "ScreenDim": { "description": "The length of time without user input after which the screen is dimmed, in milliseconds", "minimum": 0, "type": "integer" }, "ScreenOff": { "description": "The length of time without user input after which the screen is turned off, in milliseconds", "minimum": 0, "type": "integer" } }, "type": "object" }, "IdleAction": { "description": "Action to take when the idle delay is reached", "enum": [ "Suspend", "Logout", "Shutdown", "DoNothing" ], "type": "string" } }, "type": "object" }, "Battery": { "$ref": "PowerManagementDelays", "description": "Delays and actions to take when the device is idle and running on battery" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\PowerManagementIdleSettings = { "AC": { "IdleAction": "DoNothing" }, "Battery": { "Delays": { "Idle": 30000, "IdleWarning": 5000, "ScreenDim": 10000, "ScreenOff": 20000 }, "IdleAction": "DoNothing" } }

ScreenLockDelays

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ScreenLockDelays

Supported on:

• Google Chrome OS (Google Chrome OS) since version 35

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies the length of time without user input after which the screen is locked when running on AC power or battery.

When the length of time is set to a value greater than zero, it represents the length of time that the user must remain idle before Google Chrome OS locks the screen.

When the length of time is set to zero, Google Chrome OS does not lock the screen when the user becomes idle.

When the length of time is unset, a default length of time is used.

The recommended way to lock the screen on idle is to enable screen locking on suspend and have Google Chrome OS suspend after the idle delay. This policy should only be used when screen locking should occur a significant amount of time sooner than suspend or when suspend on idle is not desired at all.

The policy value should be specified in milliseconds. Values are clamped to be less than the idle delay.

Schema:

{ "properties": { "AC": { "description": "The length of time without user input after which the screen is locked when running on AC power, in milliseconds", "minimum": 0, "type": "integer" }, "Battery": { "description": "The length of time without user input after which the screen is locked when running on battery, in milliseconds", "minimum": 0, "type": "integer" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ScreenLockDelays = { "AC": 600000, "Battery": 300000 }

PowerSmartDimEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PowerSmartDimEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 70

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies whether a smart dim model is allowed to extend the time until the screen is dimmed.

When the screen is about to be dimmed, the smart dim model evaluates if dimming the screen should be deferred. If the smart dim model defers dimming the screen, it effectively extends the time until the screen is dimmed. In this case, the screen off, screen lock and idle delays get adjusted to maintain the same distances from the screen dim delay as originally configured. If this policy is set to True or left not set, the smart dim model will be enabled and allowed to extend the time until the screen is dimmed. If this policy is set to False, the smart dim model will not influence screen dimming.

Example value:

0x00000000 (Windows)

ScreenBrightnessPercent

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\ScreenBrightnessPercent

Supported on:

• Google Chrome OS (Google Chrome OS) since version 72

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies screen brightness percent. When this policy is set initial screen brightness is adjusted to the policy value, but the user can change it later on. Auto-brightness features are disabled. When this policy is unset user screen controls and auto-brightness features are not affected. The policy values should be specified in percents in range 0-100.

Schema:

{ "properties": { "BrightnessAC": { "description": "Screen brightness percent when running on AC power", "maximum": 100, "minimum": 0, "type": "integer" }, "BrightnessBattery": { "description": "Screen brightness percent when running on battery power", "maximum": 100, "minimum": 0, "type": "integer" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\ScreenBrightnessPercent = { "BrightnessAC": 90, "BrightnessBattery": 75 }

DevicePowerPeakShiftBatteryThreshold

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DevicePowerPeakShiftBatteryThreshold

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Set power peak shift battery threshold in percent.

This policy is only used if DevicePowerPeakShiftEnabled is set to true.

If this policy is not configured or left unset, power peak shift will always be disabled.

Restrictions:

• Minimum:15
• Maximum:100

Example value:

0x00000014 (Windows)

DevicePowerPeakShiftDayConfig

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DevicePowerPeakShiftDayConfig

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Set power peak shift day config.

This policy is only used if DevicePowerPeakShiftEnabled is set to true.

If this policy is not configured or left unset, power peak shift will always be disabled.

Note: allowed values for minute field in start_time, end_time and charge_start_time are 0, 15, 30, 45.

Schema:

{ "properties": { "entries": { "items": { "properties": { "charge_start_time": { "$ref": "Time" }, "day": { "$ref": "WeekDay" }, "end_time": { "$ref": "Time" }, "start_time": { "$ref": "Time" } }, "type": "object" }, "type": "array" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DevicePowerPeakShiftDayConfig = { "entries": [ { "charge_start_time": { "hour": 20, "minute": 45 }, "day": "MONDAY", "end_time": { "hour": 15, "minute": 15 }, "start_time": { "hour": 9, "minute": 0 } }, { "charge_start_time": { "hour": 23, "minute": 45 }, "day": "FRIDAY", "end_time": { "hour": 21, "minute": 0 }, "start_time": { "hour": 2, "minute": 30 } } ] }

DevicePowerPeakShiftEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DevicePowerPeakShiftEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Enable the power peak shift power management policy.

Peak Shift is power saving policy that minimizes alternating current usage during the peak usage times during the day. For each weekday a start and end time to run in power Peak Shift mode can be set. During these times the system will run from the battery even if the alternating current is attached as long as the battery stays above the threshold specified. After the end time specified the system will run from alternating current if attached but will not charge the battery. The system will again function normally using alternating current and recharging the battery after the specified Charge Start time.

If this policy is set to true, and DevicePowerPeakShiftBatteryThreshold, DevicePowerPeakShiftDayConfig are set, then power peak shift will always be enabled if supported on the device.

If this policy is set to false, power peak shift will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, power peak shift is disabled initially and cannot be enabled by the user.

Example value:

0x00000000 (Windows)

DeviceBootOnAcEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceBootOnAcEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Enable the boot on AC power management policy.

Boot on AC provides an opportunity for system to automatically boot up from OFF/Hibernate state when line power is inserted.

If this policy is set to true then boot on AC will always be enabled if supported on the device.

If this policy is set to false, boot on AC will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, boot on AC is disabled and cannot be enabled by the user.

Example value:

0x00000000 (Windows)

DeviceAdvancedBatteryChargeModeEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceAdvancedBatteryChargeModeEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Enable the advanced battery charge mode power management policy.

Advanced Battery Charging Mode allows the user to maximize the battery health. In Advanced Charging Mode the system will use standard charging algorithm and other techniques during non-work hours to maximize battery health. During work hours, an express charge is used. This express charge allows the battery to be charged faster; therefore, the battery is at full charge sooner. For each day the time in which the system will be most heavily used is specified by the start time and the duration.

If this policy is set to true, and DeviceAdvancedBatteryChargeModeDayConfig is set, then advanced battery charge mode will always be enabled if supported on the device.

If this policy is set to false, advanced battery charge mode will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, advanced battery charge mode is disabled and cannot be enabled by the user.

Example value:

0x00000000 (Windows)

DeviceAdvancedBatteryChargeModeDayConfig

Data type:

Dictionary [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceAdvancedBatteryChargeModeDayConfig

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Set advanced battery charge mode day config.

This policy is only used if DeviceAdvancedBatteryChargeModeEnabled is set to true.

If this policy is not configured or left unset, advanced battery charge mode will always be disabled.

Note: charge_start_time must be less than charge_end_time.

Note: allowed values for minute field in charge_start_time and charge_end_time are 0, 15, 30, 45.

Schema:

{ "properties": { "entries": { "items": { "properties": { "charge_end_time": { "$ref": "Time" }, "charge_start_time": { "$ref": "Time" }, "day": { "$ref": "WeekDay" } }, "type": "object" }, "type": "array" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DeviceAdvancedBatteryChargeModeDayConfig = { "entries": [ { "charge_end_time": { "hour": 23, "minute": 0 }, "charge_start_time": { "hour": 20, "minute": 30 }, "day": "TUESDAY" }, { "charge_end_time": { "hour": 6, "minute": 45 }, "charge_start_time": { "hour": 4, "minute": 15 }, "day": "FRIDAY" } ] }

DeviceBatteryChargeMode

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceBatteryChargeMode

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Specifies battery charge mode power management policy.

Dynamically control battery charging to minimize battery wear-out due to battery stress and extend battery life.

If custom battery charge mode is selected then DeviceBatteryChargeCustomStartCharging and DeviceBatteryChargeCustomStopCharging must be specified.

If this policy is set then battery charge mode will be applied if supported on the device.

If this policy is left unset and policy is supported on the device, the standard battery charge mode will be applied and cannot be changed by the user.

Note: DeviceAdvancedBatteryChargeModeEnabled overrides this policy if the former is specified.

• 1 = Fully charge battery at a standard rate.
• 2 = Charge battery using fast charging technology.
• 3 = Charge battery for devices that are primarily connected to an external power source.
• 4 = Adaptive charge battery based on battery usage pattern.
• 5 = Charge battery while it is within a fixed range.

Example value:

0x00000001 (Windows)

DeviceBatteryChargeCustomStartCharging

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceBatteryChargeCustomStartCharging

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Set battery charge custom start charging in percent.

Battery starts charging when it depletes the battery charge custom start charging value.

DeviceBatteryChargeCustomStartCharging must be less than DeviceBatteryChargeCustomStopCharging.

This policy is only used if DeviceBatteryChargeMode is set to custom.

If this policy is not configured or left unset, the standard battery charge mode will be applied.

Restrictions:

• Minimum:50
• Maximum:95

Example value:

0x0000003c (Windows)

DeviceBatteryChargeCustomStopCharging

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceBatteryChargeCustomStopCharging

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Set battery charge custom stop charging in percent.

Battery stops charging when it reaches the battery charge custom stop charging value.

DeviceBatteryChargeCustomStartCharging must be less than DeviceBatteryChargeCustomStopCharging.

This policy is only used if DeviceBatteryChargeMode is set to custom.

If this policy is not configured or left unset, the standard battery charge mode will be applied.

Restrictions:

• Minimum:55
• Maximum:100

Example value:

0x0000005a (Windows)

DeviceUsbPowerShareEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceUsbPowerShareEnabled

Supported on:

• Google Chrome OS (Google Chrome OS) since version 75

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Enable the USB power share power management policy.

Certain devices have a specific USB port marked with a lightning bolt or battery icon that can be used to charge devices like a mobile phone using the system battery. This policy affects the charging behavior of this port while the system is in the sleep and shut down modes. This policy does not affect the other USB ports and the charging behavior while the system is awake.

When awake, the USB port will always provide power.

When sleeping, if this policy is set to true, then power will be supplied to the USB port when the device is plugged into the wall charger or if the battery level is > 50%. Otherwise no power is supplied.

When shut down, if this policy is set to true, then power will be supplied to the USB port when the device is plugged into the wall charger. Otherwise no power is supplied.

If this policy is left unset, the policy is enabled and cannot be disabled by the user.

Example value:

0x00000001 (Windows)

Printing

PrintingEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\PrintingEnabled

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PrintingEnabled

Mac/Linux preference name:

PrintingEnabled

Android restriction name:

PrintingEnabled

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 8
• Google Chrome OS (Google Chrome OS) since version 11
• Google Chrome (Android) since version 39

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enables printing in Google Chrome and prevents users from changing this setting.

If this setting is enabled or not configured, users can print.

If this setting is disabled, users cannot print from Google Chrome. Printing is disabled in the wrench menu, extensions, JavaScript applications, etc. It is still possible to print from plugins that bypass Google Chrome while printing. For example, certain Flash applications have the print option in their context menu, which is not covered by this policy.

Note for Google Chrome OS devices supporting Android apps:

This policy has no effect on Android apps.

Example value:

0x00000001 (Windows), true (Linux), true (Android), <true /> (Mac)

CloudPrintProxyEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\CloudPrintProxyEnabled

Mac/Linux preference name:

CloudPrintProxyEnabled

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 17

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enables Google Chrome to act as a proxy between Google Cloud Print and legacy printers connected to the machine.

If this setting is enabled or not configured, users can enable the cloud print proxy by authentication with their Google account.

If this setting is disabled, users cannot enable the proxy, and the machine will not be allowed to share it's printers with Google Cloud Print.

Example value:

0x00000001 (Windows), true (Linux), <true /> (Mac)

PrintingAllowedColorModes

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PrintingAllowedColorModes

Supported on:

• Google Chrome OS (Google Chrome OS) since version 71

Supported features:

Can Be Recommended: No, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Sets printing to color only, monochrome only or no color mode restriction. Unset policy is treated as no restriction.

• "any" = Allow all color modes
• "color" = Color printing only
• "monochrome" = Monochrome printing only

Example value:

"monochrome"

PrintingAllowedDuplexModes

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PrintingAllowedDuplexModes

Supported on:

• Google Chrome OS (Google Chrome OS) since version 71

Supported features:

Can Be Recommended: No, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Restricts printing duplex mode. Unset policy and empty set are treated as no restriction.

• "any" = Allow all duplex modes
• "simplex" = Simplex printing only
• "duplex" = Duplex printing only

Example value:

"duplex"

PrintingColorDefault

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PrintingColorDefault

Supported on:

• Google Chrome OS (Google Chrome OS) since version 72

Supported features:

Can Be Recommended: No, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Overrides default printing color mode. If the mode is unavailable this policy is ignored.

• "color" = Enable color printing
• "monochrome" = Enable monochrome printing

Example value:

"monochrome"

PrintingDuplexDefault

Data type:

String [Windows:REG_SZ]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PrintingDuplexDefault

Supported on:

• Google Chrome OS (Google Chrome OS) since version 72

Supported features:

Can Be Recommended: No, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Overrides default printing duplex mode. If the mode is unavailable this policy is ignored.

• "simplex" = Enable simplex printing
• "short-edge" = Enable short edge duplex printing
• "long-edge" = Enable long edge duplex printing

Example value:

"long-edge"

CloudPrintSubmitEnabled

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\CloudPrintSubmitEnabled

Mac/Linux preference name:

CloudPrintSubmitEnabled

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 17

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Enables Google Chrome to submit documents to Google Cloud Print for printing. NOTE: This only affects Google Cloud Print support in Google Chrome. It does not prevent users from submitting print jobs on web sites.

If this setting is enabled or not configured, users can print to Google Cloud Print from the Google Chrome print dialog.

If this setting is disabled, users cannot print to Google Cloud Print from the Google Chrome print dialog

Example value:

0x00000001 (Windows), true (Linux), <true /> (Mac)

DisablePrintPreview

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DisablePrintPreview

Mac/Linux preference name:

DisablePrintPreview

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 18

Supported features:

Dynamic Policy Refresh: No, Per Profile: Yes

Description:

Show the system print dialog instead of print preview.

When this setting is enabled, Google Chrome will open the system print dialog instead of the built-in print preview when a user requests a page to be printed.

If this policy is not set or is set to false, print commands trigger the print preview screen.

Example value:

0x00000000 (Windows), false (Linux), <false /> (Mac)

PrintHeaderFooter

Data type:

Boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\PrintHeaderFooter

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\PrintHeaderFooter

Mac/Linux preference name:

PrintHeaderFooter

Supported on:

• Google Chrome OS (Google Chrome OS) since version 70
• Google Chrome (Linux, Mac, Windows) since version 70

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Force 'headers and footers' to be on or off in the printing dialog.

If the policy is unset, the user can decide whether to print headers and footers.

If the policy is set to false, 'Headers and footers' is not selected in the print preview dialog, and the user cannot change it.

If the policy is set to true, 'Headers and footers' is selected in the print preview dialog, and the user cannot change it.

Example value:

0x00000000 (Windows), false (Linux), <false /> (Mac)

DefaultPrinterSelection

Data type:

String [Windows:REG_SZ]

Windows registry location for Windows clients:

Software\Policies\Google\Chrome\DefaultPrinterSelection

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DefaultPrinterSelection

Mac/Linux preference name:

DefaultPrinterSelection

Supported on:

• Google Chrome (Linux, Mac, Windows) since version 48
• Google Chrome OS (Google Chrome OS) since version 48

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Overrides Google Chrome default printer selection rules.

This policy determines the rules for selecting the default printer in Google Chrome which happens the first time the print function is used with a profile.

When this policy is set, Google Chrome will attempt to find a printer matching all of the specified attributes, and select it as default printer. The first printer found matching the policy is selected, in case of non-unique match any matching printer can be selected, depending on the order printers are discovered.

If this policy is not set or matching printer is not found within the timeout, the printer defaults to built-in PDF printer or no printer selected, when PDF printer is not available.

Printers connected to Google Cloud Print are considered "cloud", the rest of the printers are classified as "local". Omitting a field means all values match, for example, not specifying connectivity will cause Print Preview to initiate the discovery of all kinds of printers, local and cloud. Regular expression patterns must follow the JavaScript RegExp syntax and matches are case sensistive.

Note for Google Chrome OS devices supporting Android apps:

This policy has no effect on Android apps.

Schema:

{ "properties": { "idPattern": { "description": "Regular expression to match printer id.", "type": "string" }, "kind": { "description": "Whether to limit the search of the matching printer to a specific set of printers.", "enum": [ "local", "cloud" ], "type": "string" }, "namePattern": { "description": "Regular expression to match printer display name.", "type": "string" } }, "type": "object" }

Example value:

"{ "kind": "cloud", "idPattern": ".*public", "namePattern": ".*Color" }"

NativePrinters

Data type:

List of strings

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NativePrinters

Supported on:

• Google Chrome OS (Google Chrome OS) since version 57

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Configures a list of printers.

This policy allows administrators to provide printer configurations for their users.

display_name and description are free-form strings that can be customized for ease of printer selection. manufacturer and model serve to ease printer identification by end users. They represent the manufacturer and model of the printer. uri should be an address reachable from a client computer including the scheme, port, and queue. uuid is optional. If provided, it is used to help deduplicate zeroconf printers.

Either effective_model should contain the name of the printer or autoconf should be set to true. The printers with both or without any properties will be ignored.

Printer setup is completed upon the first use of a printer. PPDs are not downloaded until the printer is used. After that time, frequently used PPDs are cached.

This policy has no effect on whether users can configure printers on individual devices. It is intended to be supplementary to the configuration of printers by individual users.

For Active Directory managed devices this policy supports expansion of ${MACHINE_NAME[,pos[,count]]} to the Active Directory machine name or a substring of it. For example, if the machine name is CHROMEBOOK, then ${MACHINE_NAME,6,4} would be replaced by the 4 characters starting after the 6th position, i.e. BOOK. Note that the position is zero-based.

Schema:

{ "items": { "id": "PrinterType", "properties": { "description": { "type": "string" }, "display_name": { "type": "string" }, "manufacturer": { "type": "string" }, "model": { "type": "string" }, "ppd_resource": { "id": "PpdResource", "properties": { "autoconf": { "description": "Boolean flag indicating whether IPP Everywhere should be used to set up the printer. This flag is supported on Google Chrome OS version 76 and higher.", "type": "boolean" }, "effective_model": { "description": "This field must match one of the strings which represent a Google Chrome OS supported printer. The string will be used to identify and install the appropriate PPD for the printer. More information can be found at https://support.google.com/chrome?p=noncloudprint.", "type": "string" } }, "type": "object" }, "uri": { "type": "string" }, "uuid": { "type": "string" } }, "type": "object" }, "type": "array" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\NativePrinters\1 = "{ "display_name": "Color Laser", "description": "The printer next to the water cooler.", "manufacturer": "Printer Manufacturer", "model": "Color Laser 2004", "uri": "ipps://print-server.intranet.example.com:443/ipp/cl2k4", "uuid": "1c395fdb-5d93-4904-b246-b2c046e79d12", "ppd_resource": { "effective_model": "Printer Manufacturer ColorLaser2k4", "autoconf": false } }"

NativePrintersBulkConfiguration

Data type:

External data reference [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NativePrintersBulkConfiguration

Supported on:

• Google Chrome OS (Google Chrome OS) since version 65

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Provides configurations for enterprise printers.

This policy allows you to provide printer configurations to Google Chrome OS devices. The format is the same as the NativePrinters dictionary, with an additional required "id" or "guid" field per printer for whitelisting or blacklisting.

The size of the file must not exceed 5MB and must be encoded in JSON. It is estimated that a file containing approximately 21,000 printers will encode as a 5MB file. The cryptographic hash is used to verify the integrity of the download.

The file is downloaded and cached. It will be re-downloaded whenever the URL or the hash changes.

If this policy is set, Google Chrome OS will download the file for printer configurations and make printers available in accordance with NativePrintersBulkAccessMode, NativePrintersBulkWhitelist, and NativePrintersBulkBlacklist.

If you set this policy, users cannot change or override it.

This policy has no effect on whether users can configure printers on individual devices. It is intended to be supplementary to the configuration of printers by individual users.

Schema:

{ "properties": { "hash": { "type": "string" }, "url": { "type": "string" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\NativePrintersBulkConfiguration = { "hash": "deadbeefdeadbeefdeadbeefdeadbeefdeafdeadbeefdeadbeef", "url": "https://example.com/printerpolicy" }

NativePrintersBulkAccessMode

Data type:

Integer [Windows:REG_DWORD]

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NativePrintersBulkAccessMode

Supported on:

• Google Chrome OS (Google Chrome OS) since version 65

Supported features:

Can Be Recommended: Yes, Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Controls which printers from the NativePrintersBulkConfiguration are available to users.

Designates which access policy is used for bulk printer configuration. If AllowAll is selected, all printers are shown. If BlacklistRestriction is selected, NativePrintersBulkBlacklist is used to restrict access to the specified printers. If WhitelistPrintersOnly is selected, NativePrintersBulkWhitelist designates only those printers which are selectable.

If this policy is not set, AllowAll is assumed.

• 0 = All printers are shown except those in the blacklist.
• 1 = Only printers in the whitelist are shown to users
• 2 = Allow all printers from the configuration file.

Example value:

0x00000001 (Windows)

NativePrintersBulkBlacklist

Data type:

List of strings

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NativePrintersBulkBlacklist

Supported on:

• Google Chrome OS (Google Chrome OS) since version 65

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the printers which a user cannot use.

This policy is only used if BlacklistRestriction is chosen for NativePrintersBulkAccessMode.

If this policy is used, all printers are provided to the user except for the ids listed in this policy. The ids must correspond to the "id" or "guid" fields in the file specified in NativePrintersBulkConfiguration.

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\NativePrintersBulkBlacklist\1 = "id1" Software\Policies\Google\ChromeOS\NativePrintersBulkBlacklist\2 = "id2" Software\Policies\Google\ChromeOS\NativePrintersBulkBlacklist\3 = "id3"

NativePrintersBulkWhitelist

Data type:

List of strings

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\NativePrintersBulkWhitelist

Supported on:

• Google Chrome OS (Google Chrome OS) since version 65

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: Yes

Description:

Specifies the printers which a user can use.

This policy is only used if WhitelistPrintersOnly is chosen for NativePrintersBulkAccessMode.

If this policy is used, only the printers with ids matching the values in this policy are available to the user. The ids must correspond to the "id" or "guid" fields in the file specified in NativePrintersBulkConfiguration.

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\NativePrintersBulkWhitelist\1 = "id1" Software\Policies\Google\ChromeOS\NativePrintersBulkWhitelist\2 = "id2" Software\Policies\Google\ChromeOS\NativePrintersBulkWhitelist\3 = "id3"

DeviceNativePrinters

Data type:

External data reference [Windows:REG_SZ] (encoded as a JSON string, for details see https://www.chromium.org/administrators/complex-policies-on-windows)

Windows registry location for Google Chrome OS clients:

Software\Policies\Google\ChromeOS\DeviceNativePrinters

Supported on:

• Google Chrome OS (Google Chrome OS) since version 73

Supported features:

Dynamic Policy Refresh: Yes, Per Profile: No

Description:

Provides configurations for enterprise printers bound to devices.

This policy allows you to provide printer configurations to Google Chrome OS devices. The format is the same as the NativePrinters dictionary, with an additional required "id" or "guid" field per printer for whitelisting or blacklisting.

The size of the file must not exceed 5MB and must be encoded in JSON. It is estimated that a file containing approximately 21,000 printers will encode as a 5MB file. The cryptographic hash is used to verify the integrity of the download.

The file is downloaded and cached. It will be re-downloaded whenever the URL or the hash changes.

If this policy is set, Google Chrome OS will download the file for printer configurations and make printers available in accordance with DeviceNativePrintersAccessMode, DeviceNativePrintersWhitelist, and DeviceNativePrintersBlacklist.

This policy has no effect on whether users can configure printers on individual devices. It is intended to be supplementary to the configuration of printers by individual users.

This policy is additive to the NativePrintersBulkConfiguration.

If this policy is unset, there will be no device printers and the other DeviceNativePrinter* policies will be ignored.

Schema:

{ "properties": { "hash": { "type": "string" }, "url": { "type": "string" } }, "type": "object" }

Example value:

Windows (Google Chrome OS clients):

Software\Policies\Google\ChromeOS\DeviceNativePrinters = { "hash": "deadbeefdeadbeefdeadbeefdeadbeefdeafdeadbeefdeadbeef", "url": "https://example.com/printerpolicy" }