Managed Browsers setup

[panderson]

So I am starting to work on setting up Managed Browsers.  I put some Windows machines into the Admin console.  I put them in the same location as my Chromebooks.  I didn't set or change any policies and the sign-in settings are like shown below. 

For the Chromebooks, I set my policies to block users from signing into another account (URL blocking) as discussed in our old group many times.  On the Windows machines that I am testing, the users can't get into Chrome because the sign-in page is blocked (I think from the URL Block?).  I am thinking I am missing a bunch of new settings both in the sign-in area and others.  Does anyone have any recommendations on things that I need to do?  Is it better to do this using the Windows AD Group Policies, I am guessing we wouldn't want to use both, but not sure on that either.  Any help, suggestions would be appreciated.

[rdnixon]

I enroll Chrome Browsers (via the enrollment key) into the OU the users are going to be in. The policies that apply are the Chrome user settings. This has nothing to do with ChromeOS device settings - so if you are trying to deploy them they won't do anything.  

Its also important to set the precedence policy correctly. So do you want policies applied to users to trump browser policies or the other way round. 

The typical use case for managed browsers is that when someone logs into Windows/MacOS, the browser automatically has the correct user policies applied and its not dependent on the user turning on sync. 

As far as AD goes all you need to do is push the enrollment key and then set all your user policies in one place - the admin console. You can set the policy precedence to have the user policies take over if the user turned on sync if you have OUs of users within the OU where the browser is enrolled e.g. to push different custom bookmarks to the ones everyone gets perhaps.

My blog post on the subject from a while ago: https://wpsit.blogspot.com/2022/06/using-managed-browsers-with-google.html

[Kim_Nilsson]

You shouldn't need to use URL Blocking to block users from signing into another account.

Disabling the settings for Sign-in to secondary accounts (and Multiple Sign-in Access (cros only) should take care of that.

And you need to restrict Secondary Sign-in to your Workspace domain, like this, else it will not work on Windows.

[Adotzman]

Is there anywhere in the Admin Console to restrict this secondary sign-in to be in effect only during school hours? 

Thanks!

[Kim_Nilsson]

No, not this Secondary sign-in setting,

But you can control the primary sign-in restriction on your Chromebooks here.

Here's the setting for the actual sign-in restriction.
https://admin.google.com/ac/chrome/settings/device/details/sign_in_restriction_category_item?hl=en

Here's the setting that ignores that setting for the time periods you decide.
https://admin.google.com/ac/chrome/settings/device?hl=en&table-view=false&f=POLICY_NAME.DeviceOffHou...

That setting can be controlled by time.

Do note that this, of course, doesn't work on non-Chromebooks.

[Adotzman]

Thank you!

[panderson]

Thanks, this helps!!