Google Chrome Enterprise Browser - basic setup question

[TwistedHelixis]

When setting up Google Chrome Enterprise Browser, is it best to create a single enrollment token for the entire domain, or separate tokens for each OU?

 

If one for the entire domain, should I create an OU just for this task?

[TwistedHelixis]

We are just a small primary school.

 

Is it a good idea to have separate tokens for staff and pupil OUs?

[TwistedHelixis]

So, I went with a single token in a new OU.

 

If this is wrong, post back please.

[mavhc]

Looks like the reason to have multiple tokens is to automatically enroll a device into a specific OU, so the question is: are your machines split by OU and need to be managed differently? Or are you going to require them to sign in to Chrome?

[TwistedHelixis]

are your machines split by OU and need to be managed differently?

 

I don't have any Windows devices enrolled yet, so not really sure.

We do have staff and pupils, so we might want different browser settings for those groups.

 

Soon I'm going to be setting up GCPW, users will log into Windows using GCPW, which (when its working) should automatically log that user into Chrome browser.

 

Its not clear to me if the Chrome Browser token OU is anything more than just that. if I enroll using a token in OU 1, and my users are in OU 2 & 3 does that mean I can set 'user' policies for OU 2 and 3, but only 'device' policies on OU 1? Or are device polices also in the same OU as the user that is logging in on to that device, or something else?

On the page where it lists the Enrollment tokens, it doesn't say anything about managing devices from that OU or applying policies to that OU.

 

Obviously, if the Token OU does also have an impact on which policies can be applied, then at the very least it probably makes sense to have 3 different tokens applied to 3 different OUs, Admin, Pupils and staff.

 

I just need to know if the token OU, becomes the device OU and can have different policies applied.

[TwistedHelixis]

Thinking about this a little more, there probably isn't any 'device based' policies for Chrome browser. I think they are all user based anyway.

 

Ill check when I am at a computer next

[mavhc]

Seems to say that enrollment token is only for that, enrollment, once they're enrolled you can move them around as you wish, but yeah, it's just for device based stuff