Chrome Block File Downloads Group Policy: A Practical Guide

Chrome Group Policy provides enterprise administrators with powerful controls over browser behavior across managed Windows, Mac, and Linux environments. One common requirement in security-sensitive environments involves restricting file downloads entirely or selectively. This guide walks through the practical methods for blocking file downloads using Chrome’s built-in Group Policy framework.

Understanding Chrome Group Policy

Chrome inherits policy settings from the operating system’s Group Policy Editor on Windows, or from configuration profiles on macOS and Linux. These policies override user preferences and provide centralized control for IT departments managing fleets of machines.

The policies live in the Windows Registry under HKLM\Software\Policies\Google\Chrome for machine-wide settings, or HKCU\Software\Policies\Google\Chrome for user-specific policies. On macOS, administrators deploy configuration profiles, while Linux uses JSON configuration files in /etc/opt/chrome/policies/managed/.

The Download Restrictions Policy

Chrome provides the DownloadRestrictions policy specifically designed to control download behavior. This policy accepts three integer values:

Value	Behavior
0	Allow all downloads (default)
1	Block dangerous downloads
2	Block all downloads
3	Block downloads from unknown sources

A value of 2 completely blocks all file downloads, which suits highly restrictive environments like kiosks or secure workstations. Setting this policy triggers an immediate block—no user confirmation dialog appears.

Windows Registry Configuration

For Windows environments without Active Directory Group Policy, you can directly modify the registry to apply Chrome policies:

# Block all downloads via registry
Set-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name "DownloadRestrictions" -Value 2 -Type DWord

# Or for user-specific policy
Set-ItemProperty -Path "HKCU:\Software\Policies\Google\Chrome" -Name "DownloadRestrictions" -Value 2 -Type DWord

# Restart Chrome for changes to take effect

To create the registry key if it does not exist:

# Create the Chrome policy key first
New-Item -Path "HKLM:\Software\Policies\Google" -Force | Out-Null
New-Item -Path "HKLM:\Software\Policies\Google\Chrome" -Force | Out-Null

# Then set the download restriction
Set-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name "DownloadRestrictions" -Value 2

Using Administrative Templates

For traditional Group Policy management, download the Chrome ADMX files from Google’s Chrome Enterprise bundle. After installing the templates, you find the download settings under Computer Configuration → Administrative Templates → Google Chrome → Download settings.

The policy named “Default download directory” also affects download behavior by specifying a mandatory location, while “Download restrictions” provides the UI-labeled version of the same functionality.

macOS Configuration Profile Approach

On macOS, create a configuration profile using the Profile Manager or manually with a .mobileconfig file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadContent</key>
            <array>
                <dict>
                    <key>google-chrome</key>
                    <dict>
                        <key>DownloadRestrictions</key>
                        <integer>2</integer>
                    </dict>
                </dict>
            </array>
            <key>PayloadType</key>
            <string>com.apple.ManagedClient.preferences</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Chrome Download Restriction</string>
    <key>PayloadIdentifier</key>
    <string>com.example.chromedownload</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Deploy this profile using MDM (Mobile Device Management) software or the profiles command:

# Install the profile (requires admin privileges)
sudo profiles install -type enrollment -path ChromeDownload.mobileconfig

Linux JSON Policy Configuration

For Chrome on Linux, place JSON policy files in the managed policies directory:

{
  "DownloadRestrictions": 2
}

Save this as /etc/opt/chrome/policies/managed/chrome-policy.json. Create the directory structure if it does not exist:

sudo mkdir -p /etc/opt/chrome/policies/managed
sudo tee /etc/opt/chrome/policies/managed/chrome-policy.json > /dev/null << 'EOF'
{
  "DownloadRestrictions": 2
}
EOF

Allowing Specific Download Types

If blocking all downloads proves too restrictive, combine DownloadRestrictions with DownloadAllowedURLs to create an allowlist:

{
  "DownloadRestrictions": 1,
  "DownloadAllowedURLs": [
    "https://example.com/downloads/*",
    "https://company-repo.internal/*"
  ]
}

This approach permits downloads only from specified domains while blocking potentially dangerous files from other sources.

Alternative: Using Extensions for Additional Control

For scenarios requiring more granular control than Group Policy provides, consider extension-based solutions. The Chrome Management API allows authorized extensions to intercept download requests:

// Example: Chrome extension blocking downloads (manifest v3)
chrome.downloads.onCreated.addListener((downloadItem) => {
  const blockedExtensions = ['.exe', '.msi', '.bat', '.sh'];
  const fileExt = downloadItem.filename.split('.').pop().toLowerCase();
  
  if (blockedExtensions.includes(`.${fileExt}`)) {
    chrome.downloads.cancel(downloadItem.id);
    chrome.downloads.erase({ id: downloadItem.id });
    console.log(`Blocked download: ${downloadItem.filename}`);
  }
});

However, users with administrative access can disable or remove extensions, making Group Policy more reliable for enforcement scenarios.

Verification and Troubleshooting

After applying policies, verify the configuration in Chrome by navigating to chrome://policy. This page displays all active policies and their values. Look for DownloadRestrictions in the list to confirm the policy applied correctly.

Common issues include:

Policy not appearing: Ensure Chrome is not running when applying policies, or restart after configuration
User can still download: Check if a conflicting user-level policy exists in HKCU that overrides the machine setting
Policy conflict: If multiple policies affect downloads, the most restrictive typically applies

Use Cases for Developers and Power Users

Developers might use download restrictions in development environments to prevent accidental downloads of sensitive files or to test application behavior when downloads are blocked. Power users managing shared or public machines find this policy useful for creating locked-down browsing sessions.

For enterprise environments, combining download restrictions with other Chrome policies like DisableSafeBrowsing and PasswordManagerEnabled creates a comprehensive security posture. Review the full list of Chrome policies at Google’s official documentation to build a complete configuration matching your security requirements.

Built by theluckystrike — More at zovo.one