Chrome Guest Mode for Claude Code (2026)

Last updated: April 21, 2026

How to Disable Chrome Guest Mode via Group Policy

Chrome guest mode provides a browsing option that keeps user data separate from their regular profile. While useful for temporary browsing on personal devices, many organizations need to disable this feature for security and compliance reasons. This guide explains how to disable Chrome guest mode using group policy, with practical examples for Windows, macOS, and Linux environments.

How This Relates to Claude Code Development

Developers using Claude Code to build Chrome extensions and MCP browser integrations need isolated testing environments. Chrome Guest Mode and separate profiles provide clean-slate environments for testing Claude Code-generated extensions without contamination from existing cookies, cached data, or other extensions.

Key use cases for Claude Code developers:

Testing MCP server browser connectors in a pristine Chrome environment
Validating that Claude Code-generated Chrome extensions install correctly without profile interference
Creating reproducible test environments for browser automation scripts written by Claude Code
Enterprise teams deploying Claude Code browser tools need to manage Guest Mode policies across fleets

If you are building browser tools with Claude Code, understanding Guest Mode behavior and Group Policy controls ensures your extensions work correctly across managed and unmanaged environments.

Related Claude Code guides:

Understanding Chrome Guest Mode

Guest mode in Chrome creates a temporary profile that disappears when all guest windows close. This profile does not access the user’s bookmarks, history, passwords, or other personal data. However, in enterprise environments, this feature can bypass security controls and create blind spots in compliance logging.

Group policy provides centralized management for Chrome across organization devices. By configuring the appropriate policies, administrators can remove the guest mode option entirely from the Chrome interface.

From a security standpoint, guest mode introduces several concrete problems for organizations. First, activity in guest sessions does not appear in endpoint monitoring tools that rely on the user profile for context. SIEM integrations that tie browser events to user identities lose visibility entirely. Second, extensions enforced through managed policies do not load in guest sessions, which means DLP extensions, proxy authentication plugins, and security scanning tools are silently bypassed. Third, if a device is left unattended with Chrome open, anyone can start a guest session without credentials, effectively getting anonymous internet access on a managed corporate machine.

These are not theoretical risks. Many compliance frameworks including HIPAA, SOC 2, and PCI DSS require auditability of all web activity on managed endpoints. Guest mode creates an unauditable channel that auditors flag as a finding.

Group Policy Prerequisites

Before configuring group policy, ensure you have the necessary tools installed:

Windows: Group Policy Management Console (built into Windows Pro/Enterprise)
macOS: Apple Remote Desktop or configuration profiles
Linux: Chrome Browser Cloud Management or local policy files

You also need the Chrome Browser Enterprise bundle, which includes the administrative templates (ADMX files) for group policy configuration.

Download the Chrome Browser Enterprise bundle from Google’s Chrome Enterprise page. The bundle contains ADMX and ADML template files for Windows, a sample Chrome policy file for macOS, and documentation for all supported policy keys. Always match the template version to your deployed Chrome version or use the latest available. Chrome is backward compatible with newer templates but not always forward compatible.

Chrome Policy Key Reference

Before diving into platform-specific steps, it helps to know the exact policy key names. Google uses consistent naming across platforms:

Policy Key	Type	Effect when set to false
`GuestModeEnabled`	Boolean	Removes guest mode from profile switcher
`BrowserGuestModeEnabled`	Boolean	Alternate key used in some Chrome versions
`IncognitoModeAvailability`	Integer (0/1/2)	Controls incognito mode separately
`BrowserSignin`	Integer	Controls sign-in requirements

GuestModeEnabled is the primary key covered in this guide. Note that disabling guest mode is separate from disabling incognito mode. both are independent policies. Many organizations disable both, but they require separate policy entries.

Configuring Guest Mode Disablement on Windows

Step 1: Install Administrative Templates

Download the Chrome Browser Enterprise installer from Google’s official support site. Run the installer and ensure the group policy templates are installed to the default location: C:\Windows\SysWOW64\GroupPolicy.

After installing, the templates appear in the Group Policy Object Editor under Administrative Templates. If you manage a domain, copy the ADMX and ADML files to your Central Store at \\domain\SYSVOL\domain\Policies\PolicyDefinitions\ so all domain controllers and management workstations have access.

Step 2: Open Group Policy Editor

Press Win + R, type gpedit.msc, and press Enter. Navigate to:

Computer Configuration > Administrative Templates > Google Chrome

For domain environments, open Group Policy Management Console (gpmc.msc), create a new GPO or edit an existing one, then navigate to the same path inside the GPO editor.

Step 3: Configure the Guest Mode Policy

Find and enable the policy named “Enable guest mode” (or “Enable Guest Browsing” in newer versions). Set it to Disabled.

This policy configuration appears under:

Google Chrome > Browser mode > Enable guest mode

After enabling this policy, restart Chrome or wait for group policy to refresh. The guest mode option disappears from the Chrome profile switcher.

The difference between setting a policy to “Not Configured” versus “Disabled” matters here. “Not Configured” means the policy is absent and Chrome uses its default behavior (guest mode enabled). “Disabled” explicitly pushes the false value to managed devices. Always use “Disabled” explicitly rather than relying on defaults.

Verification Command

You can verify the policy application using Chrome’s policy diagnostics:

Check applied policies in Chrome
Start-Process "chrome://policy" -WindowStyle Normal

Look for the “GuestModeEnabled” policy listed in the active policies table.

You can also check registry entries directly to confirm the policy landed:

Check HKLM policy registry key
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" `
 -Name "GuestModeEnabled" -ErrorAction SilentlyContinue
Check HKCU policy registry key (user-level policies)
Get-ItemProperty -Path "HKCU:\SOFTWARE\Policies\Google\Chrome" `
 -Name "GuestModeEnabled" -ErrorAction SilentlyContinue

A value of 0 confirms the policy is applied. If the key does not exist, the policy has not reached the machine yet. run gpupdate /force and check again.

Scoping the GPO to Specific OUs

In most environments you want to apply this policy broadly, but you may need to exclude IT administrators or kiosk devices with different requirements. Use GPO security filtering to control scope:

In GPMC, select the GPO and click the Delegation tab
Under Security Filtering, remove “Authenticated Users” if you want to target specific groups
Add the target security group (e.g., “Domain Computers” or a specific OU)
Use WMI filters if you need to target only machines running specific Windows versions

Configuring Guest Mode Disablement on macOS

macOS does not use traditional group policy, but you can achieve the same result through configuration profiles or MDM (Mobile Device Management) solutions.

Using Configuration Profile (plist)

Create a configuration profile with the following payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
 <key>PayloadContent</key>
 <array>
 <dict>
 <key>PayloadDisplayName</key>
 <string>Chrome Settings</string>
 <key>PayloadType</key>
 <string>com.google.Chrome</string>
 <key>PayloadUUID</key>
 <string>YOUR-UUID-HERE</string>
 <key>PayloadVersion</key>
 <integer>1</integer>
 <key>Name</key>
 <string>Chrome Settings</string>
 <key>GuestModeEnabled</key>
 <false/>
 </dict>
 </array>
</dict>
</plist>

Save this as chrome_guest_disable.mobileconfig and install it using:

sudo profiles install -type=configuration -path=chrome_guest_disable.mobileconfig

Deploying via Jamf Pro

If your organization uses Jamf Pro for macOS management, deploy the Chrome preference directly rather than a configuration profile:

In Jamf Pro, navigate to Computers > Configuration Profiles
Create a new profile and add a “Custom Settings” payload
Set the Preference Domain to com.google.Chrome
Upload a plist file containing the policy keys:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
 <key>GuestModeEnabled</key>
 <false/>
 <key>IncognitoModeAvailability</key>
 <integer>1</integer>
</dict>
</plist>

Scope the profile to your target Smart Group and deploy. Jamf will push the preference to enrolled machines on the next check-in cycle (typically within 15 minutes).

Verifying macOS Policy

After deploying, check that Chrome reads the managed preference:

Check managed preferences for Chrome
defaults read /Library/Managed\ Preferences/com.google.Chrome GuestModeEnabled
Alternatively check the user-level managed preferences
defaults read /Library/Managed\ Preferences/$(whoami)/com.google.Chrome GuestModeEnabled

Both should return 0. Then open Chrome and navigate to chrome://policy to confirm the policy appears in the Active policies table with the correct value and source shown as “Platform.”

Configuring Guest Mode Disablement on Linux

Linux systems using Chrome require JSON policy files placed in specific directories.

JSON Policy File Method

Create a JSON file at /etc/opt/chrome/policies/managed/guest_mode.json:

{
 "GuestModeEnabled": false
}

For per-user policies, place the file in the user’s Chrome policies directory:

mkdir -p ~/.config/google-chrome/policies/managed
echo '{"GuestModeEnabled": false}' > ~/.config/google-chrome/policies/managed/guest_mode.json

Deploying to Multiple Linux Machines

For fleets of Linux machines, distribute the policy file using Ansible:

---
- name: Disable Chrome guest mode
 hosts: workstations
 become: yes
 tasks:
 - name: Ensure Chrome managed policies directory exists
 file:
 path: /etc/opt/chrome/policies/managed
 state: directory
 owner: root
 group: root
 mode: '0755'
 - name: Deploy guest mode policy
 copy:
 content: |
 {
 "GuestModeEnabled": false,
 "IncognitoModeAvailability": 1
 }
 dest: /etc/opt/chrome/policies/managed/security_policies.json
 owner: root
 group: root
 mode: '0644'

Run the playbook against your workstation inventory:

ansible-playbook -i inventory/workstations chrome_policy.yml

The policy takes effect the next time Chrome starts or when policies are reloaded. No Chrome restart is required for policy file changes. Chrome polls its policy directory.

Verifying Linux Configuration

Check that Chrome recognizes the policy:

google-chrome --show-policy-menu

This opens Chrome’s internal policy viewer. Confirm that “GuestModeEnabled” appears with a value of false.

You can also check from the command line without opening Chrome:

Check if the policy file is valid JSON
python3 -m json.tool /etc/opt/chrome/policies/managed/guest_mode.json
Check file permissions (must be readable by Chrome)
ls -la /etc/opt/chrome/policies/managed/

If the JSON file has syntax errors or incorrect permissions, Chrome silently ignores it. Always validate JSON before deploying.

Managing Multiple Devices with Chrome Browser Cloud Management

For organizations with devices across platforms, Chrome Browser Cloud Management provides a unified interface for policy deployment.

Setting Up Cloud Management

Sign up for Chrome Browser Cloud Management through the Google Admin console
Enroll your Chrome Browser instances
Create a browser configuration with the guest mode setting disabled

The cloud management console allows you to target specific organizational units and apply policies with rollback capabilities.

Chrome Browser Cloud Management is particularly valuable for organizations with a mixed Windows/macOS/Linux environment, or where devices are not domain-joined. Enrollment requires deploying the Chrome management token to each machine, which can be done via existing MDM or software deployment tools.

Cloud Management Policy Deployment

In the Google Admin console, navigate to Devices > Chrome > Settings > Users & Browsers. Under the Security section, find “Guest mode” and set it to “Prevent guest mode.” This setting propagates to all enrolled browsers within the policy refresh interval (default: 3 hours, or immediately on Chrome restart).

Cloud Management provides a policy audit log showing when policies changed, who changed them, and which devices have received updates. This audit trail satisfies compliance requirements that on-premises group policy lacks.

Troubleshooting Common Issues

Policy Not Applying

If policies fail to apply, check these common causes:

Cache interference: Clear the Chrome policy cache by visiting chrome://policy and clicking “Reload policies”
Conflicting policies: Verify no other policy overrides your guest mode setting
Template issues: Ensure you use the correct ADMX files for your Chrome version

A common Windows scenario: the GPO applies to computers but Chrome is running as the user. Computer-level Chrome policies apply to all users on a machine regardless of which user is logged in, while user-level policies apply based on the logged-in user. For guest mode disablement, apply the policy at Computer Configuration level to ensure no user can circumvent it.

Testing Before Deployment

Always test policy changes in a controlled environment:

Force immediate policy refresh on Windows
gpupdate /force

For non-domain computers, use the Chrome policy test extension or local policy files.

A reliable testing workflow:

Apply policy to a single test machine in a separate test OU
Run gpupdate /force and restart Chrome
Navigate to chrome://policy and confirm the policy appears
Open Chrome’s profile switcher and verify Guest is absent from the menu
Check endpoint monitoring tools to confirm they still capture activity under the test user’s session
Document the test results before broad deployment

Guest Mode Still Appearing After Policy

If guest mode remains visible after applying the policy:

Confirm the policy appears in chrome://policy. if absent, the policy did not reach the machine
Check whether Chrome is running from a managed or unmanaged profile. policy only applies to managed profiles in some configurations
Verify the Chrome version supports GuestModeEnabled. very old Chrome versions (pre-69) may not honor this key
On Windows, check for user-level policy overrides in HKCU:\SOFTWARE\Policies\Google\Chrome that may conflict with machine-level settings

Removing Guest Mode Access Completely

Beyond group policy, consider these additional hardening measures:

Disable Chrome flags: Use group policy to prevent users from enabling experimental features that might re-enable guest-like behavior
Restrict profile creation: Limit users to managed profiles only by setting BrowserSignin to 2 (force sign-in)
Network-level controls: Block access to Chrome’s profile switching URLs
Disable incognito mode: Set IncognitoModeAvailability to 1 alongside the guest mode policy

The combination of GuestModeEnabled: false and IncognitoModeAvailability: 1 covers both anonymous browsing channels that compliance teams typically flag. Consider also enabling SafeBrowsingEnabled: true and MetricsReportingEnabled: true in the same policy file to improve security telemetry.

Summary

Disabling Chrome guest mode via group policy requires understanding your platform’s policy mechanisms. Windows environments use the traditional Group Policy Editor with ADMX templates. macOS relies on configuration profiles, while Linux uses JSON policy files. Regardless of platform, the core setting remains consistent: set GuestModeEnabled to false.

For mixed environments, Chrome Browser Cloud Management provides the most comprehensive solution. Remember to test policies thoroughly before broad deployment and document your configuration for audit purposes.

By controlling guest mode, organizations maintain better security posture and ensure all browser activity traces to identifiable user profiles.

I'm a solo developer in Vietnam. 50K Chrome extension users. $500K+ on Upwork. 5 Claude Max subscriptions running agent fleets in parallel. These are my actual CLAUDE.md templates, orchestration configs, and prompts. Not a course. Not theory. The files I copy into every project before I write a line of code. **[See what's inside →](https://zovo.one/lifetime?utm_source=ccg&utm_medium=cta-default&utm_campaign=chrome-guest-mode-disable-group-policy)** $99 once. Free forever. 47/500 founding spots left.

Frequently Asked Questions

What is Understanding Chrome Guest Mode?

Chrome guest mode creates a temporary browser profile that disappears when all guest windows close, without accessing the user’s bookmarks, history, or passwords. In enterprise environments, it bypasses security controls: endpoint monitoring tools lose visibility, DLP extensions and proxy authentication plugins do not load, and anyone can start an anonymous session on an unattended machine. Compliance frameworks including HIPAA, SOC 2, and PCI DSS flag this as an unauditable channel.

What is Chrome Policy Key Reference?

The primary policy key is GuestModeEnabled (Boolean), which removes guest mode from Chrome’s profile switcher when set to false. The alternate key BrowserGuestModeEnabled works in some Chrome versions. Related keys include IncognitoModeAvailability (Integer: 0/1/2) for controlling incognito mode separately, and BrowserSignin (Integer) for sign-in requirements. Disabling guest mode and incognito mode require separate policy entries – they are independent controls.

What is Configuring Guest Mode Disablement on Windows?

On Windows, install Chrome Browser Enterprise ADMX templates to C:\Windows\SysWOW64\GroupPolicy or the Central Store at \\domain\SYSVOL\domain\Policies\PolicyDefinitions\. Open gpedit.msc, navigate to Computer Configuration > Administrative Templates > Google Chrome, find “Enable guest mode,” and set it to Disabled. Verify with chrome://policy or by checking the registry key HKLM:\SOFTWARE\Policies\Google\Chrome\GuestModeEnabled where a value of 0 confirms the policy.

What is Step 1: Install Administrative Templates?

Download the Chrome Browser Enterprise installer from Google’s official support site and run it to install group policy templates to C:\Windows\SysWOW64\GroupPolicy. After installation, the templates appear in the Group Policy Object Editor under Administrative Templates. For domain environments, copy the ADMX and ADML files to your Central Store at \\domain\SYSVOL\domain\Policies\PolicyDefinitions\ so all domain controllers and management workstations have access. Always match template version to your deployed Chrome version.