We had our first stolen Chromebook this week, so I thought I’d take the opportunity to show you how we deal with lost or stolen devices.
One of the benefits of Chromebooks is that very little data is stored on the device. That means if a device gets lost your data is still secure in the cloud and isn’t at risk of being accessed by someone else. There are also several great tools built right into the Google Apps Admin Console that you can use to track, disable, and hopefully recover your Chromebook.
So, the Chromebook we lost was accidentally left unattended in a classroom and disappeared. The first thing we did was to see if we could locate the device remotely. If the Chromebook is switched on — or better yet logged on to — we’ve got a pretty good chance of recovering it. There are a few steps you can take from the comfort of your desk from the Google Apps control panel to locate a lost Chromebook.
Locating a lost or stolen Chromebook
The first thing to do is check when the Chromebook was last logged on and by who. If you know roughly when it disappeared this could give you a good indication of who might have it now.
To find out your Chromebook’s logon history do the following:
- Login to the Google Apps Admin Console
- Click Device Management > Chrome > Devices
- Locate your Chromebook in the list of enrolled devices. If you have the serial number you can use the search feature.
- Once you’ve found your Chromebook in the list, click it to view the details of the device:
- Click Recent Activity to view a list of people who recently logged onto the device and when.
In our case no-one else had logged onto the device so this was a dead-end, but it may be useful to you.
The device details screen also gives you information like the Chromebook’s Mac address and most recent sync, so if you have access to your wireless network’s admin section you may be able to track it this way as well. You can also use the Google Apps Admin Console reports page to find more detailed information about who logged in and where.
Disabling a stolen Chromebook
Google has provided some great new tools to deal with stolen or lost Chromebooks, and my favorite is the ability to disable a Chromebook until it is returned. You can also add a message to the logon screen so that anyone using it is under no illusions about who that Chromebook belongs to. Disabling a Chromebook also has the added advantage that it releases the device’s Google Apps management license so you are free to us it with a replacement device. Bonus!
To disable a Chromebook do the following:
- Login to the Google Apps Admin Console
- Click Device Management > Chrome > Devices
- Locate your Chromebook in the list of enrolled devices. If you have the serial number you can use the search feature.
- Once you’ve found your Chromebook in the list, click it to view the details of the device.
- On the left click the drop down menu and select Disable from the list:
- Then, in the new window, click Disable to stop the Chromebook being usable.
- You can also visit the “Disabled device return instructions” page (Device Management > Chrome > Device Settings) page to enter a custom message up to 512 characters giving information about how the device can be returned to the school.
You also get the option to deprovision the Chromebook from this screen. Doing so releases the management license, but it also takes it out of your control meaning that a thief could do a factory reset and make it a usable device. Unless you’re disposing of devices yourself I always recommend using the disable rather than deprovision option.
Chromebook security tip: limit who can logon to your Chromebooks with Sign-in Restriction
You can easily limit who can logon to your Chromebooks by using the Sign-in Restriction option in the Google Apps Admin Console. For security reasons we stop anyone without a school Google Apps account logging into our Chromebooks. This means that if a Chromebook is stolen it’s useless to anyone who doesn’t attend the school, and if they do attend the school any attempt to login is recorded.
To enable Sign-in Restriction do the following:
- Login to the Google Apps Admin Console
- Click Device Management > Chrome > Device Settings
- Find the Sign-in Restriction option from the list:
- Change the drop down to “Restrict Sign-in to list of users”.
- You can limit who can logon to specific users, or just your entire Google Apps domain. To only allow people within your school’s Google Apps domain to logon enter: *@domainname.com.
Wrap-Up
Disabling a Chromebook makes the device useless to any thief, discourages future thefts, and prevents them reselling the device. It’s certainly worth enabling it on all your Chromebooks even if you never expect to have to use it.
How do you make sure your devices are secure? Is there anything else you do in the event of hardware loss or theft? Let me know in the comments!
Great writeup, but only works if you have a google apps account. If you have a standard gmail account, then none of this applies 🙁
Hi,
Any schools using Chromebooks will almost certainly be using Google Apps as well.
Karl
Oh for sure schools/businesses will have google apps. I ended up here more so on the title alone, so was just pointing out for others who might be confused as to why your directions are not working for them. Chromebooks are becoming mainstream. Google needs to bring this functionality into standard gmail accounts.
These features would be great in a standard Gmail account. Great idea!
If someone stills a chromebook how can that person use the chromebook without getting tracked by the school???
Am not saying that i atold one am just curiouse ….
Hi Aditha,
I’ll assume you’re being honest when answering this. If a Chromebook has been stolen from a school the only way you could stop it being tracked would be to never turn it on. Whenever you connect an enrolled Chromebook to the Internet it immediately reports your IP address to the school from which they have a pretty good idea of your location.
Karl
So the chromebook will be tracked no matter what and if the chromebook is Deprovisioned will we still be able to track it and disable it? And can we still re-enroll
There are third party apps lil GoGuardian that actually give you a few more tools. We currently use this on our Chromebooks. They have a Stolen chrome book tracking option that allows you to create an OU for stolen Chromebooks. Put the device into that OU then when some one turns it on it logs their location and turns on the webcam and starts snapping pictures. They also have a mapping function for users. It overlays locations onto google maps where the chromebook logs in.
I am an admin for a school, and we have Google apps for education BUT since we bought the chromebooks without licenses for management, we don´t have Chromebook management enabled. I am about to by these licenses, but I was wondering – If you hard reset the computer, is it still in the domain? Is it still theft protected? If it´s not, then I probably won´t buy the licenses. I would be happy for a quick answer, since I am going to have a meeting about this on wednesday, this week. / Simon from Sweden
Hi Simon,
Yes, even if the Chromebook is factory reset it is still tied to your school’s Google Apps domain. The only way to user it afterwards is if it is returned to the school.
Hope this helps.
Karl
Yes, no way around it. Once its enrolled, its enrolled for life, until either google or you remove it.
Have a read over here, people have brought units locked and there is no way to get them working unless either google or the company that owned it removes it from their system.
Basically on reset and first boot to the internet, they contact google to see if they are enrolled anywhere etc.
https://www.reddit.com/r/chromeos/comments/2yu94n/how_can_i_remove_the_forced_enterprise_enrollment/
You should make it clear that this only works for schools, not for individuals. It’s confusing.
It’s important to note that this does NOT stop someone from removing the hard drive and accessing whatever is on the local storage. I realize that Chromebooks have an advantage that most things are not stored locally; however, that doesn’t mean that the local storage is blank. Anything purposefully stored there, especially if it was confidential will be accessible to anyone with half a brain. And if you scare them with your message when it pops up they may just destroy the thing and steal the hard drive anyways. It’s a great start, but google needs remote wipe… not just lock.
Moral of the story, don’t keep anything locally that you would be upset if it’s stolen
This is confusing, I bought some chromebooks for my classroom and thought this would work but it only works for schools!
So what if someone were to change the serial number internally, wouldn’t that kinda negate this whole thing, being that it wouldn’t be put back into the enrollment process?
Hey Karl, my daughter has recently been accused of stealing a Chromebook from her school. The school says they traced the missing Chromebook to our home location and that my daughter logged in it. However, the Chromebook she was actually using (logged into Google Classroom) at home was our own personal one. The dates and times that they report she was logged into the stolen one are the exact dates and times she was logged into our personal one. How can this happen? Why does the school tracking system think ours is the missing one belonging to the school? Its so strange. The school’s IT dept. is looking into it as well but I’m lacking confidence there. This has caused quite a stir as you can imagine. Strangely the missing Chromebook mysteriously appeared out of nowhere on a desk in the library on a day my daughter had been out sick (2nd day in a row out sick)! I need to get this figured out before we go buying a second one. I don’t want to go through this again.
dont buy another chromebook then lmao
I can’t get into the first step for some reason (1.Login to the Google Apps Admin Console) I had my chromebook stolen out of my home yesterday and I don’t know what to do! HELP PLEASE>
I lost my chromebook at my house how do I find it using tracking?
very funny… my best friend gave me his Chromebook as a birthday gift! which appears that was part of his job in a school, because after leaving the school job i couldn’t access to his account as i used to do! now i dont know what to do! no use of it at all… makes me wonder why they gave it to him and didn’t ask him to give it back and as far as i know he owns it!
Where do you find “Device Management” or even the google apps screen that you are talking about. I find nothing that says “Device Management.” It would be helpful if you gave very specific step by step instructions on how to get to these various screens. How do I find this Google Apps screen? I don’t know.
what if it was power washed, would it be able to be tracked? how? can i track it even if it was powerwashed and can i track it if he is connected to a public and any network around the world? (personal chromebook, educational chromebook, busness chromebook.
Well normal users cannot get this feature.
Hi, I misplaced my chromebook from my school, and no one would have logged on to it. Is the a fast way to know where it is?