Viewing Specifics of when User Logged into Chromebook

[MattDPenn]

Greetings all,

I wanted to get a sanity check. Is there a way to get more information about when a specific user logged into a given chromebook than the Recent Users field of a device? We have a student who is trying to avoid filters placed on them by logging into another students account which we've already tried to address twice with password changes. Now I'm seeing what is potentially a 3rd instance but I'm a bit suspicious of whether Recent User is actually updating properly to show the actual most recent to log in.

I'm also mildly annoyed that while Chrome Sync Log events appear to update relatively quickly it doesn't show what device a password or sync event occurred on. Couple that with User Log events doesn't appear to update nearly as timely nor gives info about the device logged into either and it makes it difficult to correlate these logins and which devices.

I'm already suspicious that this student is up to the same antics after being given their final chance last week as I just found their chromebook powerwashed though I'm still waiting to see if Chrome log updates with whether it was actually powerwashed. I suspect if it wasn't connected to wifi at time of powerwashing that it won't log it.

[jwisniewski]

Have you tried the investigation tool? That should give you times and ip addresses.

[MattDPenn]

I'm using various searches in the Investigation Tool but I'm trying to drill down for more info than what the tools seem to give me. The IP address doesn't help me because it just shows the schools WAN IP address not the LAN IP address that's specific to the chromebook.

[kaned]

If you pay for Edu Plus, you can use the investigation tool.

Security -> Security Center -> Investigation tool -> User Log Events

You might be able to do something with GAM, but I think when I looked last it was difficult to correlate the two logs.

[MattDPenn]

I'm trying to use the User Log Events investigation, amongst other investigations, but User Log Events doesn't appear to update in a reasonable amount of time. I know the 2nd student, or the 1st student logging in as 2nd student, has been logged into something via Chrome Sync log and GoGuardian logs today but User Log Events still doesn't show any logins. Nor does clicking on a event show me which device it happened on despite their devices being enrolled.

[don_b_nashville]

Always felt sanity was overrated myself, but I share your experience with the recent users field. More often than not, seems like it has stale information. YMMV but that's what I'm seeing here. We run Workspace plus Teaching/Learning, so not based on Investigation tool, just direct thru console and using GAT+ and GAT Shield. Here we disable powerwash for students. More on that here:  https://www.techlockdown.com/guides/chromebook-google-workspace#configure-device-restrictions 

[Josh]

I do this frequently. This is recorded and searchable via the Chrome Log in the investigation tool.

https://support.google.com/a/answer/9393909?hl=en