Best Practice: Configuring Chromebook With Google Apps

Enrolling Chromebooks in a Google Apps domain is extremely simple, but if you’re starting fresh there are a lot of configuration settings that you’ll want to get right first time.

I won’t go through all of the options — there are far too many to list and each is well explained in the Google Apps control panel — but I will mention features I felt were most relevant to us. Each use case is different, so you may find that these don’t apply to you or that others that I’ve missed off do. Let me know in the comments!

Chromebook Wireless Network Configuration

Getting the Chromebook’s WiFi configuration correct is essential. You can, if you choose, simply set up the configuration manually on each device, but this doesn’t give much flexibility in future. Luckily the Google Apps control panel allows us to manage the Chromebook WiFI settings remotely.

Google Apps gives you a surprising number of options for configuring Wi-Fi. In many respects the GAFE control panel is a simpler and more effective way to manage device WiFi than Microsoft’s Group Policy.

How your teachers and students are using the Chromebooks will depend on how you set up WiFi. If your users will have their own dedicated Chromebook you may want to look at using WPA2 Enterprise and authenticate your users against Active Directory via RADIUS.  For more information on how to do this take a look at Google’s guide, in particular check out the “Username Variables” section.

If you just have a shared trolley of Chromebooks, the above configuration is probably not necessary. As long as you’re authenticating users further down the line, unless you’re extremely security conscious, a standard Pre-Shared Key (PSK) configuration pushed out by the Google Apps control panel is probably sufficient.

Here’s how I recommend doing it:

Create a new Organisational Unit for Your Chromebooks

The first thing you will want to do is drop your Chromebooks into their own suborganisation (Google’s equivalent of an Active Directory Organisational Unit). Doing this will allow you to manage groups of devices more effectively and apply settings in a more granular fashion.

1. Open your Google Apps for Education control panel.
2. Go to the Devices tab and select the top level of your domain. Any newly enrolled Chromebooks will be listed.
3. Select the Chromebook(s) you want to move.
4. Click “Move to” and select the suborganisation that you want to move them to. You can create new suborganisations by clicking the “Add suborganisation” button. In this case my Chromebooks are going to be used within the Science department, but you may want to organise them type room name or type of user (students, teachers etc.).

Configuring Chromebook WiFi Settings

Chromebooks rely on a solid Internet connection to do everything. This means that the device has to be able to connect to the WiFi before the user can logon, but once logged on we may want to, for example, switch to a different Wi-Fi network depending on whether they are a student or a teacher.

To do this we need to have two stages of WiFi authentication. One, to allow the device to connect to the Internet before the user has signed in so that Google can authenticate them, and a second to authenticate the user against our WiFi network once they have successfully logged in.

1. Click Settings > Chrome Management > Networks
2. Select the top level of your domain. Here we will create the first level of WiFi authentication. This policy will apply to all Chromebooks within our domain and is used by the device to connect to the WiFi network before the user logs on. Without this the Chromebook will never connect to the Internet and will never be able to authenticate users.
3. In the bottom pane labeled “Settings” click “Add WiFi” and enter your WiFi and proxy server configuration settings.
   

Once these settings have taken effect your Chromebooks will automatically connect to WiFi.

To set alternate settings based on the end user click “For Users”, select the suborganisation you want to affect, and “Add Wi-Fi” again in the same way. As with Active Directory, the closer the suborganisation on which the settings are configured is to the user the higher priority it has.

Proxy server settings can be set within either the User Settings or Networks menus.

Additional Chromebook Settings

Under the Settings > Chrome Management menu there are many additional settings that you should be aware of. Some of the options that were important for us are below.

 Chromebook Guest Mode

When a user signs into a Chromebook using guest mode,  your organisation’s policies are not applied. We disabled this option.

 Wi-Fi Username Variables

If you’re authenticating your users against RADIUS the username variable option will simplify configuration for your users.

Your Chrome devices can automatically try to connect to a secure network with the username or full email address of the currently logged-in user. Your users then only need to provide their password to authenticate. To use this feature, specify one of the following variables in the Username and/or Outer identity fields during configuration:

Show user names and photos on the sign-in screen

We disabled this option to prevent a list of previously signed-on users stacking up on the login screen.

These changes may take up to 24 hours to propagate to all users

When saving settings you are warned that “These changes may take up to 24 hours to propagate to all users”. By rebooting the machine, however, you force a policy refresh.

Dogfooding

Finally, the thing which taught us the most about Chromebook use by far was actually buying one and using it for day to day tasks. Unless you can develop work flows and familiarity with a new device you’re never going to be able to pass on that invaluable experience to your students.

Even if none of the advice above is relevant to you go and buy a Chromebook today and just use it!