Manage Google Chrome with UEM - alternative way

[Pim_van_de_Vis]

The biggest issue with managing Google Chrome with UEM is that Chrome stores a lot of data in the %LocalAppData% folder, making it very time consuming to import and export that location.

Google provides an option to make Chrome store the browser user profile information in the Roaming AppData folder, to make it compatible with roaming user profiles.

This option stores most personal Chrome settings in a small 'profile.pb' file. This is a huge improvement over the original location, that can easily grow to 100's of megabytes.

This page describes the solution:

Using Chrome on roaming user profiles - Chrome for business and education Help

The site provides an ADMX template that can be imported in UEM 'ADMX based settings'.

You only need to enable the setting called 'Enable the creation of roaming copies for Google Chrome profile data'.

This will create the '%AppData%\Google\Chrome\User Data\Default\profile.pb' file, which we will further manage with a UEM config file (attached to this post).

The roaming user profile (profile.pb) contains information such as bookmarks, autofill data, passwords, per-computer browsing history, browser preferences, and installed extensions.

The downside it that the 'profile.pb' file doesn’t contain information about cookies, browsing sessions, cached or downloaded files, and other local browser instance and transient data.

I found out that capturing the 'Cookies' file from the LocalAppData folder, together with the 'profile.pb' file solves the cookies issue.

Attached is a UEM config file that you can use to test this new approach. It's not perfect yet, because some personal settings are still missing, but by including the correct specific files from LocalAppData we might get it to roam all settings, while still maintaining a small and fast UEM profile.

Please give this a try, and let me know what you are missing, or what files need to be included additionally to make this work.

[burgerking68]

Hi Pim,

very interested in this.

But I can't find the ADMX Template for UEM Import inside the link...:smileycry:.

Greetings

Andreas

[DEMdev · Accepted solution]

Hi Andreas,

We can't distribute Google's ADMX template, but you can download it at https://dl.google.com/dl/edgedl/chrome/policy/policy_templates.zip (and, just in case that download URL changes, the page that references it: Set Chrome policies for devices - Chrome for business and education Help​)

[burgerking68]

Thanks UEMdev for your support!

Greetings:

Andreas

[solgaeDK]

Roaming profiles support was added in version 57, so just make sure you're running that version if you have auto-update disabled via policy.

I could swear many admins have been asking google for this for years...and finally, someone from Google gets it. Not everyone wants to use Google Cloud Sync.

[alsmk2]

What size does this reduce an average profile to out of interest?

[JohnTwilley]

My old profiles were very large...around 30 MB

This method seems to keep it under 1MB. (So Far...Day one of testing)

My only issue right now is that the "Welcome to Chrome" tab shows up on every login.  I have the policy set to not show it...but it keeps coming back.

UPDATE: 

1) I found that I had previously enabled the "Disable Synchronization of data with Google" in a UEM ADMX policy.  This prevents the local sync from working.

   This policy should not be enabled when RoamingProfileSupportEnabled policy is set to enabled as that feature shares the same client side functionality. The Google-hosted synchronization is disabled in this case completely.

I still had the "Welcome to Chrome" tab upon each login, as it is trying to sync with Google...and wants the User Credentials.

2) Added a couple of more lines to let Chrome know it has been run before.

[IncludeFiles]

<AppData>\Google\Chrome\User Data\Default\profile.pb

<LocalAppData>\Google\Chrome\User Data\Default\Cookies

<LocalAppData>\Google\Chrome\User Data\First Run

<LocalAppData>\Google\Chrome\User Data\Default\Preferences

Give this a try!

John

[alsmk2]

30mb is a small Chrome profile already in my mind, but 1mb is exceptional.

How does this handle plugins?

[JohnTwilley]

OK.  So I have been testing this on a dozen different Horizon Pools, including Win7 (32-bit), Win7 (64-bit), Win10 (64-bit).

These pools have various Google Chrome versions...mostly 62.x.x - 63.x.x.

The Sync works GREAT.  I'm a huge fan of using this method...cause here's the best part.    ** Drum-Roll **

   Google Chrome.zip = 141 KB   <==>   Google Chrome = 3,500 KB    (Depending on Cookies)

Now this is mostly just Bookmarks, Content settings, Form Data, Browsing history, and Browser preferences.

We do not allow Extensions, which would really start to add up space.  But it is NOWHERE near the 30 MB that we used to have per user.

Chrome opens faster, because we use DirectFlex and it no longer has to pre-import such a large zip file.

One issue I did have, was that it was not consistently syncing on some of the PCs.  I found that for some reason, Google Sync was disable in the registry in those master images (HKCU), even though I was enabling it via UEM ADMX entries...not real sure why.

Adding the following registry entry in UEM resolved the issue.

[HKEY_CURRENT_USER\Software\Policies\Google\Chrome]

"SyncDisabled"=dword:00000000

"RoamingProfileSupportEnabled"=dword:00000001

I've added a screen shot of the users Google Chrome.zip files.  Everything ABOVE the blue line was automatically converted to the Local Sync method.

Since I'm saving Cookies, they can grow by a few MB.   Still, it is much better.

Happy Syncing !!

[lansti]

Hey, i have updated the admx files, and when i try to enable the creation of roaming copies for google chrome profile data policy in UEM, and used the direct flex with :

[IncludeFiles]

<AppData>\Google\Chrome\User Data\Default\profile.pb

<LocalAppData>\Google\Chrome\User Data\Default\Cookies

and tried to use these settings into predefined settings:

[HKEY_CURRENT_USER\Software\Policies\Google\Chrome]

"SyncDisabled"=dword:00000000

"RoamingProfileSupportEnabled"=dword:00000001

I do not get it to work.

If i disable the policy and remove:

[HKEY_CURRENT_USER\Software\Policies\Google\Chrome]

"SyncDisabled"=dword:00000000

the direct flex "works", but users have to log in to chrome to get their shortcuts every time(non presistant desktops).

The good part is that the config file is small....

Which file do store all credentials that i need so users can start chrome and they get their account logged in and get their bookmarks?

[ElJefe61]

Anyone know how to make it so users who want to sign in can do so and get their bookmarks, etc.?  It looks like if you use this method it will only sync locally saved data.

[bcbomb47]

Did you ever find a way to make it so a user can sign in to the Google account to sync bookmarks, etc? We are seeing the same issue in our environment. They can sign in but the synced information isn't showing up. Thanks.

[SchwarzC]

I also experience problems with cookies - users need to re-login to e.g. gmail each time the login to their machine.

Something I am missing?

[IncludeFiles]

<AppData>\Google\Chrome\User Data\Default\profile.pb

# By capturing this file the Cookies will be saved

<LocalAppData>\Google\Chrome\User Data\Default\Cookies

# surpress Welcome to Chrome Tab https://communities.vmware.com/thread/578914 (Source)

<LocalAppData>\Google\Chrome\User Data\First Run

<LocalAppData>\Google\Chrome\User Data\Default\Preferences

<LocalAppData>\Google\Chrome\User Data\Default\Login Data

<LocalAppData>\Google\Chrome\User Data\Default\History

Thanks!

[SchwarzC]

This fixed itself with the latest UEM Version - 9.4

[Justin_Y]

Can you give more detail on what was fixed in 9.4 for Chrome and UEM

Added onto the recipe and this is working for us to retain extensions as we allow a few on a Whitelist. We exclude the Adobe and Webex extensions we have added via GPO as they automatically install. We get the benefit of avoiding the welcome screen and it is a much smaller profile. The Excluded hidden chrome extensions took up the most space, Youtube, Wallet and Chromecast.

[IncludeFiles]

<AppData>\Google\Chrome\User Data\Default\profile.pb

# By capturing this file the Cookies will be saved

<LocalAppData>\Google\Chrome\User Data\Default\Cookies

# surpress Welcome to Chrome Tab https://communities.vmware.com/thread/578914 (Source)

<LocalAppData>\Google\Chrome\User Data\First Run

<LocalAppData>\Google\Chrome\User Data\Default\Preferences

<LocalAppData>\Google\Chrome\User Data\Default\Login Data

<LocalAppData>\Google\Chrome\User Data\Default\History

# Retain Extension customizations and first run tabs

<LocalAppData>\Google\Chrome\User Data\Default\Extension Cookies

[IncludeFolderTrees]

<LocalAppData>\Google\Chrome\User Data\Default\Extensions

[ExcludeFolderTrees]

#Adobe,Webex

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\jlhmfgmfgeifomenelglieieghnjghma

#Youtube,Google Wallet,Chromecast

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\Temp

[DEMdev]

Happy to hear that 9.4 made something Chrome-related work for SchwarzC, but nothing in particular was fixed in 9.4 in relation to Chrome.

[JahnsTek]

As SchwarzC and lansti said, I am also having the issue where users have to re-sign into websites each time they login to a new session. I'm still at UEM 9.3, but if "nothing in particular was fixed in 9.4 in relation to Chrome," how do I get this cookie/session data to persist across sessions?

I've tried the Chrome.zip config as well as this thread's "alternative way"... I've even tried not excluding any directories/files (capturing the entire Chrome user dir), but same issue...

I've now upgraded UEM to 9.5.0 and Google Chrome to 70.0.3538.77, but this issue still continues...

Anybody find a solution to get Chrome to persist cookie/session data across sessions?

Thanks,

Justin

[lansti]

Hi, my experience with this is that in UEM you need to include a folderthree in "windows settings - internet explorer":

In the webCache there is a DAT file with alot of this information, correct me if i'm wrong..

But I experience that users logins follows when i include this file in UEM import/export..

Give it a try, even if the file might build up...

[revyve]

I've also enabled this with the roaming profile per the thread, but on every logon syncing is paused with google and prompts for user logon to google.  So does this method work when the users also want to sync Google in a non persistent?

Here is a copy of the settings I'm attempting in UEM that work for everything except google chrome always prompting to logon to google account every time:

[IncludeFiles]

<AppData>\Google\Chrome\User Data\Default\profile.pb

<LocalAppData>\Google\Chrome\User Data\Default\Cookies

<LocalAppData>\Google\Chrome\User Data\First Run

<LocalAppData>\Google\Chrome\User Data\Default\Preferences

<LocalAppData>\Google\Chrome\User Data\Default\Login Data

<LocalAppData>\Google\Chrome\User Data\Default\History

<LocalAppData>\Google\Chrome\User Data\Default\Favicons

<LocalAppData>\Google\Chrome\User Data\Default\Top Sites

<LocalAppData>\Google\Chrome\User Data\Default\Extension Cookies

[IncludeFolderTrees]

<LocalAppData>\Google\Chrome\User Data\Default\Extensions

<LocalAppData>\Google\Chrome\User Data\Default\Thumbnails

<LocalAppData>\Microsoft\Windows\WebCache

[ExcludeFolderTrees]

#Youtube,Google Wallet,Chromecast

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm

<LocalAppData>\Google\Chrome\User Data\Default\Extensions\Temp

[JahnsTek]

I've been beating my head on this issue of Google Chrome needing users to re-sign into websites (including Google Cloud Sync being paused) each time they login to a new session... And finally found the solution for my environment...

lansti mentioned needing the UEM built-in "Windows Settings > IE WebCache" enabled, but that did not do it for me. What worked in my environment (UEM 9.5, Chrome 71) was enabling the "Windows Settings > Personal Certificates" config.

Oddly, when I look at the current user personal certificates via MMC, there is nothing specific to Google Chrome. So I'm not sure what specifically is being persisted in this config to resolve this issue with Google Chrome, but it works in my testing.

Also, now that this is working, I've switched back to the non-roaming-profile method (https://communities.vmware.com/docs/DOC-31428), as we have users that use the Google Cloud Sync feature of Chrome (which is disabled when enabling roaming profile support).

Hope this tidbit helps someone else...

Thanks,

Justin