How to effectively manage many Chromebooks and users at School

In general, when a school distributes computers to students, it requires the cost and staffing of user preferences, software, OS updates, security software updates, and replacement or repair for other computers in the event of a malfunction.  

Chromebook is easy to manage remotely through the Chrome Device Management Console. Administrator can manage all of their environments, software to be installed, automatic OS updates, and the ability to use the Internet only on a controlled network.

If a Chromebook is lost or if it is stolen in a cafe, the administrator can remotely disable the device directly and the device will be immediately logged out and no longer available. If a lost Chromebook is retrieved, the administrator can make it available immediately by changing the device to reuse.

To efficiently manage the many Chromebooks distributed to students at school, Chrome Device Management console is required. The Chrome device management console allows administrator or teacher to define and set up more than 150 policies. But It's more complicated than it sounds, and it takes a lot of time and effort to figure it out and use it efficiently. 

Key policy settings for Chrome Device Management

If you're using a Chromebook at a school that uses G Suite for Education, you may be confused by the difference between user settings and Chromebook device settings.

User settings can be set through admin console of G Suite for Education. However, Chrome Device Management console is required for Chromebook device-specific settings.

There are more than 150 policies that can be set through Chrome Device Management. The settings can be broadly categorized into five categories - User Settings, Network Settings, Device Settings, Public Session Settings, and Kiosk Settings.

One important aspect of setting up Chrome devices is setting Chrome devices to Public Session, Kiosk Settings, and Single App Kiosk Mode.

For example, if you are using a chromebook for multiple users, a business center PC, a PC for book searching in a bookstore or library, or a public PC used by several production workers in a production plant for business purposes, Device Management is setting this as a public session. You can use your PC without a login in a public session.

A single app kiosk setting lets you run only a single specified app, which only works in full-screen mode. Other apps, including things like regular Internet search, will not be available.

Typically, the most important of the administrative settings at a school will be User settings and Device settings. Public session and kiosk mode settings are optional depending on your Chromebook usage.

Differences between user and device settings

• User policies apply regardless of which devices are logged in
• Targeted users in the domain through the Admin Console.
• Control your Chrome browser environment
• Allowed apps and extension controls
• Force apps and extensions to install
• Chrome Web Store Permission Limitations
• Browser environment control - Incognito mode, history, ad hoc mode, safe browsing, malicious sites, remote access client allowed
• Proxy settings
• Control the use of screenshots, block and allow access URLs
• Print control etc.
•  Organizations that use G Suite for Education users can manage policies in the G Suite Admin console.
• Schools that do not use G Suite for Education must acquire Chrome Device Management Console licenses..

• Device policies are to control and manage devices regardless of who logs in.
• Control who can log in, how to update, etc.
• Control how users operate the device rather than what they use on the device

● Device registration and access

● Allow Guest Mode, Login Restrictions (Use only specified users), SSO,

● Chrome OS auto-update control, distribution channel control

● Manage kiosk settings

● Device status reporting

● Scheduled reboot

● Cloud Print Management

● Bluetooth control

● Stop using your device remotely

•       Device policies can only be controlled through the Chrome Device Management console through Chrome device management licensing.

●         Each policy is mutually exclusive. - There is no policy that conflicts with each other.

You can manage all users using Chromebook and set up network without having to register your device. However, device management or opt-in settings, kiosk settings, device provisioning /deprovisioning, etc. are only available if you have a Chrome Device Management license.

Companies that use Chromebooks without G Suite will need a Chrome device management license to manage their Chromebooks and manage their users.

Management topics	G Suit /GSuite for Education Admin Console	Chrome device management console
User Settings	O	O
Network Settings	O	O
Device Settings	X	O
Public Settings	X	O
Kiosk Settings	X	O
Device Provision/Deprovision	X	O

For More information - https://goo.gl/IMl8Bu Kindle Store - Paperback/Kindle Edition

-----------

[TIP:Google Drive] Differences between Transferring ownership of documents, Copying Document, and Creating a virtual file for a document?

What are differences between Transferring ownership of documents, Copying Document, and Creating a virtual file for a document?

(Subtitle: Cautions for Collaboration in Google Drive)

This is one of the key issues we hear from Google Drive-intensive customers.

“"Folders and files created by me in My Drive are shared between departments, projects, and external team members, and shared files sometimes disappear or disappear unintentionally when collaborating. How can I find and restore these files? "

There are things to be aware of when creating and collaborating with others by creating a file or folder on Google Drive.

1. Be careful when transferring or deleting files or folders that someone shared with you to My Drive
1. When you move a file that someone else has shared with you in My Drive, never drag it to another folder.
2. This moved file will disappear from the shared owner's folder and all shared team members' folders. (This is called an orphaned file.) Due to this phenomenon, even the owner who created the document may lose the file in the folder.
3. When you move a shared file to another folder in My Drive, you must use it to 'CTL key (ALT' key on Mac) + drag mouse '(copy virtual file).
4. When copying a virtual file, '+' icon will be shown.
5. Virtual file copying means that the original is kept in its original location and is virtually added to my drive. In other words, it is not to copy the owner's file to make a copy, but to make the link information of some kind of file be added to another place. When the virtual file is modified, the original is also automatically modified.
   
   

 

2. Differences between transferring file ownership and copying files
1. One of the special features of Google Drive is that there is an "Owner" You can delete documents or folders created by the owner only.
2. When you view detailed information for a file, you'll see who is "owner" and who has shared it. The owner can pass ownership of the document to anyone else who wants it (only those who have a Google Account on the same domain).
3. When an employee leaves the company, the administrator can transfer all the files in the drive of the leaving person to another person in the same domain. If you want to transfer it in part, you must manually transfer the ownership by selecting the documents or files in My Drive (do not copy the drive but transfer ownership)
4. The major difference between making copies of documents and transferring ownership is that,
1. If you make a copy - the revision history, the version history, and the comment history of the  document will be removed.
2. If you pass over ownership - The original is not copied and there is only one copy and all the record information (revision history, version history, comment history, etc.) existing in the document is preserved.
5. Transfer of ownership is only allowed within the same domain. Users with personal gmail accounts can transfer ownership to and from individual gmail users. For example, kim@gmail.com can transfer documents to hong@gmail.com.

3. Difference between Copy File and Virtual File creation (CONTROL Key + Mouse Drag-in-Drag-out)
1. One of the other features of Google Drive is the ability to create virtual files.
2. Generally, a file copy means it make a duplicated file.
3. Creating a virtual file means that there is only one file in the original, and not copying, but creating only the link information of the original file.
4. You can create virtual files to as many folders as you want, and when you modify the virtual file, the original is also automatically modified at the same time. Of course, if you delete this virtual file, the original will also disappear.
   
   
4. How to search and restore orphaned files (files that were not deleted but could not be found in My Drive)
1. One of the things that can happen only with Google Drive is that you can have orphaned files.
2. Scenarios for Orphaned files
1. The owner kim@mycompany.com shares the folder Project-A to hong@mycompany.com and the owner creates the document "Agenda" in the Project-A folder
2. the hong@mycompany.com deletes the Agenda document from the Project-A folder or moves it to another folder.
3. If this happens, the "Agenda" document will disappear from the folder "Project-A" in the owner's drive.
4. These files are called orphaned files: this "Agenda" document can not be found in the trash because it was not physically deleted because it was not deleted by the owner.
3. How to find and restore an orphaned file or folder
1. Search with "is:unorganized owner: me" in the search box of the owner drive and the search result is displayed, you can select the file or folder and move to the desired folder.

--------------
Book: Advance Chrome Device Management & 2017 Essential Guide for Chromebook Users : https://goo.gl/IMl8Bu Kindle Store - Paperback/Kindle Edition)

[Tip:Chrome Device Management ] Chrome Release Channel best practices

While the majority of your users will be on the Stable channel of Chrome OS, if your organization has a large number of Chromebooks, there are several reasons why you should always keep some devices on the Beta channel:

Google recommends that you keep most of your users on the Stable channel, and 5% of your users on the Beta channel. We also recommend you keep your IT team on the Beta or Dev channels.

There are three types of Chrome OS releases: Stable, Beta, and Dev. You can set the release channel for your Chrome device users in the Admin console under Device management > Chrome > Device Settings.

Keep 5% of your organization on the Chrome OS Beta channel

While the majority of your users will be on the Stable channel of Chrome OS, if your organization has a large number of Chromebooks, there are several reasons why you should always keep some devices on the Beta channel:

• Your organization will get a 4-6 week preview of new features.
• Some features you discover may require you to communicate additional information to your organization.
• Some features may not be suitable for all of your users, and you may need to investigate ways to block these features.
• In some cases, you may find issues which could impact the use of the devices in your environment. Finding this out early enough with fewer devices will give you enough time to contact Google, and if we can’t resolve the issue, block the update before it hits all of your users.

As a general rule, we recommend you keep at least 5% of your devices on the Beta channel at all times. If you have multiple types of hardware, we recommend you keep 5% of each type of hardware on the Beta channel.

Google will actively investigate issues on the Beta channel. Please contact Enterprise support to report any issues that you notice.

Keep your IT staff on the Beta and Dev channels

In addition to keeping most of your IT staff on Beta channel, it can be helpful to keep some devices on the Dev channel, which will give you 9-12 week preview of what is coming to the stable version of Chrome OS. Benefits of being on the Dev channel include the following:

• Your IT staff can test to make sure that your apps and systems are compatible with the latest Chrome OS software updates and feature changes.
• While we automatically fix most issues before the release is marked as stable, we may not be able to catch all the corner cases which may uniquely impact your environment. Should any issues arise, your developers and IT staff can identify and report (via the Chromium site) any changes that may impact your environment before they reach the Beta or Stable channel.

Note that the Dev channel, by its nature of being an early release of Chrome, is not 100% stable, and should be used by IT staff or developers. Since some instability is expected, the Dev channel is more useful for staying aware of upcoming features in the OS.

For More information - https://goo.gl/IMl8Bu Kindle Edition

[How to set and manage Chrome policies for students using Chromebook]

At school, you may need to install only the apps specified by the school on Chromebooks that students use, or control Chrome extensions. It is necessary to prohibit students from visiting harmful sites on Chromebook.


G Suite administrator can create and control policies for users who use Chromebooks.

• User policies apply regardless of which devices are logged in
• Targeted users in the domain through the Admin Console.
• Control your Chrome browser environment
• Allowed apps and extension controls
• Force apps and extensions to install
• Chrome Web Store Permission Limitations
• Browser environment control - Incognito mode, history, ad hoc mode, safe browsing, malicious sites, remote access client allowed
• Proxy settings
• Control the use of screenshots, block and allow access URLs
• Print control etc.
• Organizations that use G Suite or G Suite for Education users can manage policies in the G Suite Admin console.
• Companies and schools that do not use Google Apps must acquire and manage Chrome Device Management Console licenses.

How to set Chrome policies for users.

As a Chrome administrator for your organization, you can set policies for how people use their Google Account on a Chrome device, an Android device, or the Chrome browser. These policies are cloud-managed, so they apply when signing in from a personal or public device. The policies don't apply to users signed in as guests or with a Google Account outside of your organization (such as a personal Gmail account).

You can also set device-level policies on corporate-managed Windows®, Mac®, and Linux® computers.

Android apps can run on Chrome OS on supported device models only. We are constantly adding support for new devices. To allow your users to run Android apps, you must enable Android apps on supported Chrome devices in your organization.

Before you begin

Turn on Chrome Management

For Chrome user policies to work on Windows, Mac, or Linux computers, Chrome Management must be turned on in your Admin console.

1. Sign in to the Google Admin console.
2. From the Admin console dashboard, go to Apps > Additional Google Services.
3. Next to Chrome Management, click  .
4. Choose ON for everyone, ON for some organizations or OFF.
   For more detailed steps, see  Turn Chrome Management on or off.

If you purchase Chrome device management licenses: Chrome policies still apply for users who sign in to a managed Chrome device, even if Chrome Management is turned off.

Set up user policies

Before you begin: To turn the service on or off for select groups of users, put their accounts in an organizational unit.

1. Sign in to the Google Admin console.
2. From the Admin console dashboard, go to Device management.
3. On the left, click Chrome management.
4. Click User settings. 
5. On the left, select the organization to which you want the settings to apply to. Learn more
   Important: Make sure Chrome Management is turned on for this organization.
6. Make the settings you want. A  marks settings that don't apply to all devices (click the  for details).
   Tip: Quickly find a setting on the User settings page by typing in Search settings at the top.
7. At the bottom, click Save.
   Settings typically take effect in minutes. But they might take up to an hour to apply for everyone.

Sample 1 :  In Chrome Device Management Console, Device management  > Chrome >  User Settings > General -> Avatar

  

Sample 2: Forcing administrators to automatically install apps and extensions to users in the "Sales" organization. Device management> Chrome> User settings> Force installed apps and extensions



Three apps that are installed by the administrator after installation are automatically installed



Sample 3: User Settings> Startup > Home Button, Forcing the home button to be removed, and forcing the administrator to load the home page at startup




"Home" button forced to disappear from user's browser Automatically display the homepage specified by the administrator at startup.

For More information - https://goo.gl/IMl8Bu Kindle Edition

[TIP] What is Smart Lock on a Chromebook and how do I use it?

Using Smart Lock on your Chromebook

If you are a frequent user of a Chromebook, the boot speed is very fast when you turn on your Chromebook and you must enter it each time on the sign-in screen.

The Smart Lock feature on your Chromebook is designed to ease this inconvenience. This means that if you have a smartphone near your Chromebook, you can sign in without a password.

To enable this feature, your smartphone must be at least Bluetooth-enabled Android 5.0, and your Chromebook must be Chrome OS version 40 or higher.

On your Chromebook, you'll need to select Settings menu> Show advanced settings> Use Smart Lock for Chromebook (Beta). When it is selected to use, search for a Bluetooth-enabled smartphone in the vicinity and select the desired smartphone.

After your Smart Lock setup is complete, if your smartphone is nearby and you're signed in, your Chromebook's login status will also be unlocked as shown in the screen below, in which case you can sign in directly without entering your password by clicking the login picture with your mouse. If your smartphone is logged out or powered off, your Chromebook's login will also require a password to sign in.

On your smartphone, you need to set up Settings> Security> Smart Lock> Trusted device.

For more information- https://goo.gl/IMl8Bu  - Paperback/Kindle Edition)