Prevent users from downloading harmful files

Chrome version 61 and later.

For administrators who manage Chrome browser or Chrome OS devices for a business or school.

As a Chrome administrator, you can use the DownloadRestrictions policy to prevent users from downloading dangerous files, such as malware or infected files. You can prevent users from downloading all files or those that Google Safe Browsing identifies as dangerous. If users try downloading dangerous files, they get a security warning that they can’t bypass.

Step 1: Review the policy

Policy: DownloadRestrictions

There are many types of download warnings within Chrome that can generally be categorized as follows: 

• Malicious, as flagged by the Safe Browsing server.
• Uncommon or unwanted, as flagged by the Safe Browsing server.
• A dangerous file type. For example, all SWF downloads and many EXE downloads.

For more details on these categories, see Google Chrome blocks downloads.

Setting the DownloadRestrictions policy blocks different subsets of these, depending on it's value:

• 0—Default. No special restrictions.
• 1—Blocks malicious files flagged by the Safe Browsing server and blocks all dangerous file types. 
  Note: We only recommend setting this policy for organization units, browsers, or users that do not regularly incorrectly identify an entity, such as a file or a process, as malicious.
• 2—Blocks the following files:
  • Malicious files flagged by the Safe Browsing server.
  • Uncommon or unwanted files flagged by the Safe Browsing server.
  • All dangerous file types. 

  Note: We only recommend setting this policy for organization units, browsers, or users that do not regularly incorrectly identify an entity, such as a file or a process, as malicious.

• 3—Blocks all downloads. Not recommended, except for special use cases.
• 4—Recommended. Blocks malicious files flagged by the Safe Browsing server but does not block dangerous file type.

Unset: Defaults to No restrictions, as described above.

What the policy restricts

These restrictions apply to downloads that are triggered on webpages when users click a download link on the page or right-click a file and choose Save link as.

What the policy does not restrict

The restrictions do not apply when users save a webpage by clicking File  Save page as, or Print  Save as PDF. 
For more details, see What is Safe Browsing?

Step 2: Set the policy

Click below for steps, based on how you want to manage these policies.

Admin console

Can apply for signed-in users on any device or enrolled browsers on Windows, Mac, or Linux. For details, see Understand when settings apply.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to DevicesChrome.
3. Click SettingsUsers & browsers.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
5. Scroll to Chrome Safe Browsing.
6. For Download restrictions, choose an option:
   • No special restrictions
   • Block all malicious downloads
   • Block dangerous downloads
   • Block potentially dangerous downloads
   • Block all downloads
7. Click Save.

Windows

Applies to Windows users who sign in to a managed account on Chrome browser.

Using Group Policy 

In your Group Policy Management​ (Computer or User Configuration folder):

1. Go to Policies  Administrative Templates  Google  Google Chrome.
2. Enable Allow Download Restrictions.
3. Set an option:
   • No special restrictions
   • Block all malicious downloads
   • Block dangerous downloads
   • Block potentially dangerous downloads
   • Block all downloads
4. Deploy the policy to your users.

Mac

Applies to Mac users who sign in to a managed account on Chrome browser.

In your Chrome configuration profile, add or update the following key and then deploy the change to your users.

Set the DownloadRestrictions key to <integer>value</integer>, where <value> is 0, 1, 2, 3, or 4.

Example code:

<key>DownloadRestrictions</key>
  <dict>
  <integer>1</integer>
</dict>

Linux

Applies to Linux users who sign in to a managed account on Chrome browser.

In your preferred JSON file editor, add or update a JSON file and then deploy the change to your users.

1. Go to your etc/opt/chrome/policies/managed folder.
2. Set the DownloadRestrictions key to 0, 1, 2, 3, or 4.

Example code:

{
"DownloadRestrictions": "1"
}