Fix: Updates Are Disabled by Administrator in Chrome

If Chrome’s About page says Update failed: Updates are disabled by administrator, a management policy is telling Chrome’s updater not to update. That policy does not live inside Chrome, so reinstalling the browser will not clear it. Start by checking whether your browser is actually managed: open the three-dot menu and look at the very bottom.

What You Need Before You Start

Applies to: Google Chrome on Windows and Mac.
Chrome version: Not version-specific.
Account: Know whether you are signed in with a personal Google Account or a work or school one.
Access: Some steps need an administrator account on the computer. On a device your employer or school owns, you may not be allowed to change this at all.

Why Does Chrome Say Updates Are Disabled by Administrator?

Chrome does not update itself from inside the browser window. A separate updater program does that work, and it reads update policy before it does anything. When a policy says updates are off, the updater reports the failure and Chrome shows you the message. There are three common reasons that policy exists, and you can usually tell them apart in under a minute.

The device really is managed. Your signal: the bottom of Chrome’s three-dot menu reads Managed by your organization, and chrome://policy lists policies someone else set. Google’s own check is exactly this. If you do not see that line in the menu, your browser is not managed.
A Mac has an update policy file. Your signal: you are on a Mac and there is a file at /Library/Managed Preferences/com.google.Keystone.plist. Google documents that file as the place Google Software Update reads its policies, under an updatePolicies key with an UpdateDefault value. A value of 3 means updates are never applied.
A Windows PC is still joined to an organization. Your signal: Settings > Accounts > Access work or school lists a connected account you no longer use. This is worth checking on any laptop that was bought second-hand or kept after a job ended. Chromium’s updater documentation is blunt about it: update policies are only respected on devices that are domain-joined, enrolled in Chrome Enterprise Core, or managed by MDM on a Mac. If the message appears, some form of enrollment is usually still in place.

How Do I Check Whether Chrome Is Managed?

Open Chrome and click the three-dot menu at the top right.
Look at the bottom of the menu, below the normal entries. If it says Managed by your organization, your browser is managed. If nothing is there, it is not.
Type chrome://policy in the address bar and press Enter to see what has been set.
Click your profile picture and check the account. A personal account ends with @gmail.com. A work or school account ends with a company or school domain.

If the account is a work or school one, stop here. The update block is your organization’s decision, and Google’s advice is to contact your administrator rather than work around it. Trying to strip management off a device your employer owns can break other things you need, and it may breach the rules you agreed to.

How Do I Fix This on a Mac?

On a Mac, the update setting arrives as a managed preference, usually placed there by a configuration profile from a device management service.

Open Finder, press Shift + Command + G, and go to /Library/Managed Preferences/.
Look for com.google.Keystone.plist. If it is there, open it and find updatePolicies, then UpdateDefault.
Note the value. Google documents 0 as normal automatic updates, 1 as scheduled checks only, 2 as manual checks only, and 3 as never applied. A 3 is your answer.
Open System Settings and look for a device management or profiles entry. If a profile is listed, that profile is what wrote the file.
Remove the profile only if the Mac is genuinely yours and you know what installed it. Otherwise, ask whoever manages the Mac to change the update policy at their end.

Deleting the plist by hand is not the fix. The file is the result of the profile, not the cause, so removing the file leaves the profile in place and the setting can return. Deal with the profile instead.

How Do I Fix This on Windows?

On Windows, the usual cause is an enrollment that is still attached to the PC. It happens on a laptop bought second-hand, or on one you kept after leaving a job.

Before you do this, disconnecting a work or school account removes your access to that organization’s email, apps, and files on this computer. Microsoft also notes that management software installed by the organization gets removed, including its endpoint protection, so make sure your own antivirus is switched on afterwards. Do this only on a computer that is yours.

Open the Settings app.
Go to Accounts > Access work or school.
Select the connected account you want to remove, then click Disconnect.
Click Yes to confirm.
Restart the computer.
Open Chrome, go to Settings > About Chrome, and look at the update status again.

If no account is listed and the message still appears, treat it as unwanted software rather than enterprise management. Google’s steps for a personal device are to remove programs and extensions you do not recognize, reset Chrome settings, then restart Chrome and the computer.

What Does Not Fix This

Reinstalling Chrome. The updater is a separate program with its own policy source, and the policy sits outside Chrome’s own files. A fresh copy of Chrome reads the same policy and reaches the same answer.
Running Chrome as an administrator. Nothing is being blocked by file permissions. The updater is refusing on purpose, and it refuses with the same policy no matter who launched the browser.
Creating a new Chrome profile or signing out. Policies set at device level apply to everyone on that computer, whether or not anyone is signed in to the browser.
Clicking Check for updates again. On a Mac set to the strictest value, Google documents that the setting also blocks users from installing updates manually from the About page.
Assuming other updates prove it is fine. Google says parts of Chrome keep updating even when browser updates are turned off, including Widevine DRM and the updater’s own recovery component. Watching something update is not evidence that your browser is current.

Frequently Asked Questions

Can I just download Chrome from Google and install it over the old one?

You can, and on a managed machine it will not hold. The policy is still there after the install, so the updater blocks the next update exactly as before. On a Mac set to the strictest update value, Google documents that manual installs from Chrome’s About page are blocked too.

Does this mean someone is watching what I browse?

Not by itself. An update policy only controls updates. A managed browser can allow an administrator to see more than an unmanaged one, so it is worth understanding what the label does and does not mean, but the update block on its own tells you nothing about monitoring.

Why do updates fail only at certain times of day?

That is a different setting. Google documents an update window for managed Macs, set with UpdatesSuppressedStartHour, UpdatesSuppressedStartMin, and UpdatesSuppressedDurationMin. Inside that window, updates are held back, and outside it they run normally.

Is it safe to keep using Chrome while updates are blocked?

It gets less safe the longer it goes on, because security fixes ship with updates. If the device belongs to an organization, tell whoever runs it that your browser has stopped updating. If the device is yours, treat the block as something to clear rather than ignore.

Wrapping Up

This message is not a broken download or a bad connection. Something on the computer is telling Chrome’s updater to stand down, and the fix is to find what that is. Check the bottom of the menu first, then the managed preference on a Mac or the work account on Windows, and go to the administrator if the device is not yours.