Set the default web browser via group policy?

In our company we are testing a Chrome deployment that will be used alongside Internet Explorer. Only a select few of our users are local admins on their machines, so most individuals are locked down pretty tight obviously. One of the complaints we've had during this testing stage however has been that users cannot set Chrome as their default browser if they choose. It asks the users when they launch if they want to make Chrome default, and they choose yes, but it doesn't seem to take. Strangely, the "Internet" program listed at the top of the start menu changes, but when clicking on shortcuts to websites or anything else it defaults to IE. Is there a way to allow users this limited control via a GPO? Thanks for any help anyone can provide!

For the record, I've tried logging in as them (with non admin rights) and forcing Chrome to be default several different ways, but it just won't take, so it's definitely a permissions issue.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Justin OwensITIL Problem ManagerCommented:
That is a machine based setting, not a user based setting, meaning that if any user has the rights to change default application handling on a machine, it will change that default for all users on that machine.  Obviously, this is not an issue if your users never share machines, but that is the reason that it is a difficult item to delegate.

This article:

has a list of delegate rights and privileges available to AD via GPO.  Changing default program is not in the list.  It requires administrative rights, out of the box.  Now, I suppose you COULD really dig into the OS and write a custom security template to address that, but I have no idea how to help you with that.
danielabrooksAuthor Commented:
Thanks DrUltima. Our users don't share PC's, and even if they did, I wouldn't care to make it a global policy. Admin rights for all is definitely not an option though. Oh well, I guess I'm really hoping someone else has encountered this issue and created a template for this purpose.
Justin OwensITIL Problem ManagerCommented:
Honestly, your easiest solution would be to log into those computers and change the default browser with an admin account.  Unless you have hundreds of machines affected, it would be faster than writing a custom security template.

CompTIA Network+

Prepare for the CompTIA Network+ exam by learning how to troubleshoot, configure, and manage both wired and wireless networks.

danielabrooksAuthor Commented:
Actually, there are about 300 PC's this would effect, so that's not a very attractive option unfortunately. And I would really like them to just be able to choose.
You could always try to deploy a reg file that would set it up for you. This may change depending on the OS.
danielabrooksAuthor Commented:
Thanks Pacane, but the point is to allow the user to be able to set their own browser. I don't our IT department bothered every time a user wants to change their default browser.
You should be able to do this with a logon script.

This is an example logon script for making firefox the default browser

Option Explicit

' Force Default Browser
Dim Shell
Set Shell = CreateObject("")
Shell.Run ("firefox.exe -silent -setDefaultBrowser")
Set Shell = Nothing

If you replace the firefox.exe with the chrome exe then this should work.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
danielabrooksAuthor Commented:
I appreciate all the help guys, but I'm not trying to set the default browser with a login script or by any other means, I can figure that part out. What I'm trying to do is modify the user permissions to allow them to be able to change the default browser on their own.

Does anyone know how to do THAT?
Justin OwensITIL Problem ManagerCommented:
Not without Admin rights....
if you are able to write a small yes no aplication that will run on start up that asks the user if they would like to have chrome as the default and if they click yes then you can run the comand "chrome.exe -silent -setDefaultBrowser" and it will set it for them. Not sure if it will work if the user isnt a local admin but its an idea.
danielabrooksAuthor Commented:
Thanks for the suggestion, but that's just not practical for a 300 PC network.
Justin OwensITIL Problem ManagerCommented:
Actually, it is, but if it is run as a logon script (i.e, tied to the user account), you will still have the Admin rights problem.  If you run it as a startup script (i.e., tied to the computer account), you bypass the Admin rights problem, but I am not sure how that would work if no one is logged in to answer the yes/no app....

You could write a script which runs with admin rights, but that places a user name and password in clear text where users could see it.  Not a good idea, ever.

danielabrooksAuthor Commented:
The answer wasn't the one I was looking for, but it was the best possible choice given the limitations of Windows.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.