Getting started basics of setting up a Chromebook in G Suite

[TwistedHelixis]

We have just taken delivery of our first batch of Chromebook - YAY

 

I have looked over this help page but would prefer some Edugeek help along the way.

https://support.google.com/chrome/a/answer/1360534?hl=en&ref_topic=9028498

 

Just wondering if someone could give me the initial steps needed to start rolling them out or answer a few questions.

 

I assume I need to create OUs for the devices, would you recommend something like this....

 

Root > Chrome Devices > Pupil devices

Root > Chrome devices > Staff devices

 

To enrol a device do I need any settings applied to my admin account first

 

Do I need to apply any settings to the pupil & teacher OUs first.

 

Basically any basic steps to kick me off would be great

 

Yes we do have Chrome Education Upgrade licenses, apparently they have been applied to G Suite already

Edited October 1, 2020 by TwistedHelixis

[DGardiner]

We have just taken delivery of our first batch of Chromebook - YAY

 

I have looked over this help page but would prefer some Edugeek help along the way.

https://support.google.com/chrome/a/answer/1360534?hl=en&ref_topic=9028498

 

Just wondering if someone could give me the initial steps needed to start rolling them out or answer a few questions.

 

I assume I need to create OUs for the devices, would you recommend something like this....

 

Root > Chrome Devices > Pupil devices

Root > Chrome devices > Staff devices

 

To enrol a device do I need any settings applied to my admin account first

 

Do I need to apply any settings to the pupil & teacher OUs first.

 

Basically any basic steps to kick me off would be great

 

Yes we do have Chrome Education Upgrade licenses, apparently they have been applied to G Suite already

You can check the licences in billing, they can be a pain to get assigned form some resellers....

 

Your instructions cover you, it really is that simple!

 

 

We just have our chromebooks in an OU under the users for compartmentalising them into each school/area the majority of the options youwill change in admin will come down from the users Settings anyway - Device Settings are more likely to be global in nature ive found

[paulkerton]

You can check the licences in billing, they can be a pain to get assigned form some resellers....

 

Here is where I let you into a little secret. All the resellers have to buy them from the same distributor, who then actions them.

I won't point fingers as to who that is, but trust me, any pain is not from your reseller!

[DGardiner]

The google man?

 

They always seem to be the thing were left chasing!

[jmak]

Have you sorted out synchronising user accounts with your Active Directory?

 

Not sure if it's mentioned in the guide you linked, but there's an option to pre-populate your domain for user sign in. If you set that, the login will be the same on Chromebooks as on Windows devices.

[jthompson]

As with everything in G Suite Admin, I'd recommend just going through every settings screen and working out what you want each item set to. It's Google, so the defaults are likely to be quite permissive.

[paulkerton]

The google man?

 

That's the one. A man made purely of Googles...

or 1 guy at 1 distributor responsible for all things Google. Literally all things. Whichever you prefer to imagine.

 

As with everything in G Suite Admin, I'd recommend just going through every settings screen and working out what you want each item set to. It's Google, so the defaults are likely to be quite permissive.

 

Yes. This.

And to add to this, I'd create your OU structure, and then just enroll two devices. One for staff and one for students.

Put them into their respective Sub-OUs, and start configuring that way. First at the top level for all devices, then at the sub-OUs for the staff and students respectively.

Regular reboots of the devices too, so you can see the changes as you configure.

 

Then when you enroll the rest, just put them into their correct OUs and you're away.

Edited October 1, 2020 by paulkerton

[jthompson]

Probably worth bearing in mind that the User & browser settings under Devices -> Chrome -> Settings will apply to users signing into privately owned Chromebooks, so you don't want to snooker anybody with proxy settings that they can't turn off, etc.

[TwistedHelixis]

Have you sorted out synchronising user accounts with your Active Directory?

No and yes.

The school still logs in using a class default but I created Y5 & 6 logins recently. In the end I just downloaded csv from SIMS made a few changes and imported this into G Suite & DC, although I have just found out these Chromebooks are for 1-2-1 in year 6 and they will not need to access the windows systems

[jmak]

I'd still look at setting up AD Connect to synchronise - you then only have one place to manage user accounts.

 

Also, you're likely to use Google accounts more and more; I got into a battle with Microsoft and Google as (predictably) neither would accept responsibility for why the new accounts which were auto provisioned into Google from AD worked perfectly, but the pre-existing accounts logged in but didn't have access to the data they had before they were synchronised. I'm sure you can guess who had to deal with the mess...

[TwistedHelixis]

You can check the licences in billing, they can be a pain to get assigned form some resellers....

 

is this correct, it says chrome upgrade licences = 1? We have 65 Chrome devices

 

Also, should 'devices > networks' be assigned to the devices or users OU?

Edited October 1, 2020 by TwistedHelixis

[DGardiner]

is this correct, it says chrome upgrade licences = 1? We have 65 Chrome devices

 

Also, should 'devices > networks' be assigned to the devices or users OU?

 

Yes thats the right licence.

 

and if you want the devices to connect prior to login you need to send it to device.

[DGardiner]

Oh and if youre playing setup, chrome://policy is your friend for reloading/viewing applied settings.

 

Might save you a headache i had yesterday.

 

In the root, Set user & browser settings, Change Download Location to force google drive! I cleared profiles off 100 chromebooks the other day and ate peoples "download folders" since they had been local and not saved to drive by default..

 

Id check it has the intended outcome before guaranteeing that though, ive only turned it on after i caused the fire!

[TwistedHelixis]

Just had a thought, I will be enrolling them using my admin account, does the OU my admin account is in also need the same Chrome OU user settings that the pupils or teachers will have applied to their OUs?

 

Hope that makes sense

[DGardiner]

Just had a thought, I will be enrolling them using my admin account, does the OU my admin account is in also need the same Chrome OU user settings that the pupils or teachers will have applied to their OUs?

 

Hope that makes sense

 

Theres an enrolment setting somewhere in there which sets this, by default all chromebooks will popup in the root - You can change the setting to move to the OU the user that enrolls it is in.

 

https://support.google.com/chrome/a/answer/2657289#device_enroll_permission

 

 

I wouldnt worry about the Device locations as much unless you want the base machine config to be different

 

The device will apply its device settings based on that OU, then apply the user settings over the top as they log in.

 

Its not as overlapping as youre probably used to with GPO

[TwistedHelixis]

So what's the best way of applying the network settings based on different proxy settings for pupils and staff? I am thinking, what if a teachers needs to logon to a pupils device how do I a) make sure they have internet so they can login and b) have the correct proxy applied.

 

Current OU structure

 

Root > Chrome Devices > Pupil devices

Root > Chrome devices > Staff devices

 

Root > Pupils

Root > Staff > Teachers

 

Can I set the pupils proxy settings for Root > Chrome Devices, this should ensure that everyone can logon

Can I then set the Staff proxy on Root > Staff, will this then override the pupils proxy with the Staff proxy.

 

Or do I need to apply pupils proxy to Root > Chrome Devices > Pupil devices

and the staff proxy to Root > Chrome devices > Staff devices

This option obviously means they cant switch devices

 

EDIT - I know you mentioned - The device will apply its device settings based on that OU, then apply the user settings over the top as they log in, but I just wanted to double check

Edited October 2, 2020 by TwistedHelixis

[TwistedHelixis]

Also if I apply a setting to Root > Chrome Devices and then a similar setting to Root > Chrome Devices > Pupil devices which one wins?

[paulkerton]

Also if I apply a setting to Root > Chrome Devices and then a similar setting to Root > Chrome Devices > Pupil devices which one wins?

The one further down, as you have overridden the it.

So in this case Pupil Devices.

 

Apply general settings at Chrome Devices

Apply specific settings for pupils at Pupil Devices

[paulkerton]

EDIT - I know you mentioned - The device will apply its device settings based on that OU, then apply the user settings over the top as they log in, but I just wanted to double check

Apply the student network at the device OU as a per device network

Apply the staff network on the staff OU as a per user network.

 

That will let everyone log in via the student network, and then the staff can access their specific network settings as a user once logged in.

[TwistedHelixis]

I have now created the device policies and all looks good.

 

in the user policies what do you have set for - Enrollment permissions - options are

 

enroll a new or re-enroll a deprovisioned device

re-enroll existing devices (cannot enroll new or deprovisioned devices)

Do not allow users in this organization to enroll new or re-enroll existing devices

 

Thanks

[paulkerton]

I have now created the device policies and all looks good.

 

in the user policies what do you have set for - Enrollment permissions - options are

 

enroll a new or re-enroll a deprovisioned device

re-enroll existing devices (cannot enroll new or deprovisioned devices)

Do not allow users in this organization to enroll new or re-enroll existing devices

 

Thanks

 

Do not allow users in this organisation to enroll new or re-enroll existing devices. No one needs it except those you want to be able to enroll a device onto the Admin Console. I'd give that to maybe those 2 or 3 geeky kids who want to help IT wise as and when they'd need it and you have 300+ to enroll, but that's it.

 

Also make sure for the devices, you have force re-enroll wiped devices switched on.

 

https://support.google.com/chrome/a/answer/6352858?hl=en

[jthompson]

I have now created the device policies and all looks good.

 

in the user policies what do you have set for - Enrollment permissions - options are

 

enroll a new or re-enroll a deprovisioned device

re-enroll existing devices (cannot enroll new or deprovisioned devices)

Do not allow users in this organization to enroll new or re-enroll existing devices

 

Thanks

Do not allow here, but then set to allow on our Admins OU. Given that Chrome upgrade licenses cost money and are not reassignable, you don't want them being used up by people who aren't directly tasked with managing your fleet of devices.

[TwistedHelixis]

Thanks for the help, you lot are a life saver.

 

Another question (sorry). Would you force install the Google Classroom app from the Android store or use the browser version, is the app better?

Edited October 2, 2020 by TwistedHelixis

[TwistedHelixis]

Almost there... Just a couple more questions

 

1) Will the settings (specifically user settings) effect someone's personal Chrome device that they have logged onto at home using the school login, or do these settings only effect devices that are licenced in G Suite?

 

2) I notice little symbols on some of the settings that indicate chrome browsers (not Chrome OS) does that mean I would be changing everyone's Chrome browser settings on their windows devices if I change these settings

Just answered this one and yes they do change the settings on everyone's computers

Edited October 2, 2020 by TwistedHelixis

[DGardiner]

Thanks for the help, you lot are a life saver.

 

Another question (sorry). Would you force install the Google Classroom app from the Android store or use the browser version, is the app better?

 

Id avoid android stuff unless you need it - Has to be downloaded per profile