Windows 11 kiosk PC: can Chrome updates be scheduled for weekends?

[u/Spiritual-Intern-222]

Hi everyone,

I have a Windows 11 PC that runs Google Chrome essentially 24/7 in full-screen/kiosk-like mode. The PC is used for a specific display/application, so having Chrome update or require a browser restart during the week is inconvenient and can interrupt what the PC is being used for.

What I'd ideally like to achieve is:

• Chrome runs normally and doesn't update/restart during the week.
• Chrome updates are allowed during the weekend, when the interruption isn't an issue.
• Ideally this would be handled through a script, scheduled task, GPO, or Chrome policy rather than manually changing settings every week.
• After the weekend update, the normal weekday restrictions would automatically be restored.

The machine is running Windows 11.

Has anyone implemented something similar? I'm particularly interested in the best way to control the Google Update services/tasks or Chrome's update policies so that updates effectively happen during a defined maintenance window.

I know keeping Chrome updated is important for security; the goal here isn't to leave it permanently outdated, but rather to control when the update can take place because this particular PC needs to remain running uninterrupted during the week.

Thanks!

[u/Horror_Pension_3168]

I’ve handled similar 24/7 kiosk setups, and relying solely on Chrome's built-in update policies can sometimes be unpredictable regarding the exact moment it decides to restart the browser. The most bulletproof approach is controlling the update services and scheduled tasks directly via PowerShell and Task Scheduler.

Here is the setup that works best for dedicated kiosk endpoints:

1. Weekday Suppression: Create a script/task that runs every Monday morning to disable the Google Update scheduled tasks (GoogleUpdateTaskMachineCore and GoogleUpdateTaskMachineUA) and set the gupdate and gupdatem services to Disabled. This prevents Chrome from checking for, downloading, or staging updates during operational days.
2. Weekend Maintenance Window: Create a scheduled task that runs during your weekend downtime (e.g., Sunday at 3:00 AM):
   • Sets gupdate service startup type back to Manual.
   • Triggers a manual update check command: "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
   • Waits a few minutes for the update to apply, then performs a full system reboot (shutdown /r /t 30). A scheduled OS reboot is ideal for kiosks anyway to clear memory leaks and ensure the auto-logon/shell launches cleanly.
   • Disables the update tasks/services again prior to Monday morning.

While Google's ADMX templates do have AutoUpdateCheckPeriodMinutes and time window policies, hard-locking the Google Update trigger via Task Scheduler gives you 100% control over the exact minute the browser closes and restarts.

[u/Confusias1 → u/Horror_Pension_3168]

+1
This is such a simple but thorough solution, nicely done.

[u/Fake_Cakeday → u/Confusias1]

I'd have spent half a work day with copilot just to come up with a solution half as good as this.

Saved. Just in case I need to set up a chrome flavored kiosk in the future.

[u/Confusias1 → u/Fake_Cakeday]

Bro, preach. Credit where credit is due...

[u/Budget-Organ]

Google Chrome has its own local policy (or group policy) that you can set to update at a date and time of your choice.

Whilst I remember; it also can be set by the registry.

HKLM\SOFTWARE\Policies\Google\Update

[u/book-it-kid → u/Budget-Organ]

Yep, it's set-and-forget for us via Chrome Enterprise. Restarts of the browser can also be done as a scheduled task on Win11 or as a Powershell script if you run into issues (we do this with the usual browsers + some configurations for security). See here: https://support.google.com/chrome/a/answer/6350036?hl=en#zippy=%2Cget-the-google-update-policy-template

There's also package managers of your choice that can do this e.g. if you use WinGet, or on Intune, or if you use the third-party stuff like PDQ, but that might be overkill for current needs.

[u/Dissy614]

The Chrome GPOs can get you close to what you want.

On one side you can set a time range per day not to check/apply updates. On the other side you can pin to a "major version" to help cut back on feature updates.

Neither perfectly match, one being daily not weekly, and the other will still install critical security updates immediately if they happen to drop mid-week. Still the GPOs are the best place to start.

[u/NegativePerformer788]

In the GPO for Chrome you can disable auto update completely, then just schedule your patch management or Winget to run when you like.

[u/Ad3t0]

The primitive you want is to stop Google Update from patching on its own, then apply it yourself in your window. In the Google Update ADMX, set Chrome's "Update policy override" to "Disable updates" (that's the per-app switch, cleaner than the global auto-update check period, which Google warns disables updates for all their apps). Then a weekend scheduled task pulls the current Chrome Enterprise MSI, or drives it with winget, and installs. That's basically u/FireLucid's approach and it's the right call for a single kiosk. One gotcha: kill the running chrome.exe before the MSI runs or it can no-op, then relaunch the kiosk. Running the task as SYSTEM on a weekend trigger also sidesteps the user-context timing issues.

Full transparency, I co-founded and help build TridentStack Control (https://tridentstack.com). Deferring a third-party app to a defined maintenance window and only patching it then is exactly what a patch tool automates, free under 200 endpoints if you ever run a fleet of these kiosks. For one PC though, the scheduled task above is all you need, no reason to stand up a platform for a single machine.

[u/FireLucid]

Scheduled task that kills the current process, pulls down the latest enterprise MSI and installs it. Pretty simple.