topic Re: Managed Browsers setup in Peer-Peer Topics

Managed Browsers setup

panderson — Fri, 20 Oct 2023 21:15:23 GMT

So I am starting to work on setting up Managed Browsers. I put some Windows machines into the Admin console. I put them in the same location as my Chromebooks. I didn't set or change any policies and the sign-in settings are like shown below.

For the Chromebooks, I set my policies to block users from signing into another account (URL blocking) as discussed in our old group many times. On the Windows machines that I am testing, the users can't get into Chrome because the sign-in page is blocked (I think from the URL Block?). I am thinking I am missing a bunch of new settings both in the sign-in area and others. Does anyone have any recommendations on things that I need to do? Is it better to do this using the Windows AD Group Policies, I am guessing we wouldn't want to use both, but not sure on that either. Any help, suggestions would be appreciated.

Re: Managed Browsers setup

rdnixon — Sat, 21 Oct 2023 06:11:21 GMT

I enroll Chrome Browsers (via the enrollment key) into the OU the users are going to be in. The policies that apply are the Chrome user settings. This has nothing to do with ChromeOS device settings - so if you are trying to deploy them they won't do anything.

Its also important to set the precedence policy correctly. So do you want policies applied to users to trump browser policies or the other way round.

The typical use case for managed browsers is that when someone logs into Windows/MacOS, the browser automatically has the correct user policies applied and its not dependent on the user turning on sync.

As far as AD goes all you need to do is push the enrollment key and then set all your user policies in one place - the admin console. You can set the policy precedence to have the user policies take over if the user turned on sync if you have OUs of users within the OU where the browser is enrolled e.g. to push different custom bookmarks to the ones everyone gets perhaps.

My blog post on the subject from a while ago: https://wpsit.blogspot.com/2022/06/using-managed-browsers-with-google.html

Re: Managed Browsers setup

Kim_Nilsson — Sat, 21 Oct 2023 06:22:19 GMT

You shouldn't need to use URL Blocking to block users from signing into another account.

Disabling the settings for Sign-in to secondary accounts (and Multiple Sign-in Access (cros only) should take care of that.

And you need to restrict Secondary Sign-in to your Workspace domain, like this, else it will not work on Windows.

Re: Managed Browsers setup

panderson — Mon, 23 Oct 2023 14:00:06 GMT

Thanks, this helps!!

Re: Managed Browsers setup

Adotzman — Fri, 01 Mar 2024 20:56:00 GMT

Is there anywhere in the Admin Console to restrict this secondary sign-in to be in effect only during school hours?

Thanks!

Re: Managed Browsers setup

Kim_Nilsson — Mon, 04 Mar 2024 10:44:18 GMT

No, not this Secondary sign-in setting,

But you can control the primary sign-in restriction on your Chromebooks here.

Here's the setting for the actual sign-in restriction.
https://admin.google.com/ac/chrome/settings/device/details/sign_in_restriction_category_item?hl=en

Here's the setting that ignores that setting for the time periods you decide.
https://admin.google.com/ac/chrome/settings/device?hl=en&table-view=false&f=POLICY_NAME.DeviceOffHours

That setting can be controlled by time.

Do note that this, of course, doesn't work on non-Chromebooks.

Re: Managed Browsers setup

Adotzman — Tue, 05 Mar 2024 13:37:18 GMT

Thank you!