Chromebook Access Control
Owner: Brian Johnson; Author: June Peters; Reviewers: Amy Spivey, John Brooks
Summary:
This page is intended to inform IT, Academic Technology, school leadership, teachers, and parents of the layers of control for the Chrome browser and Chromebook devices along with who controls each layer in each context. It is written as a collaboration between IT, Academic Technology, and school leadership. While the subject is deeply technical, it is intended to be understood by anyone.
There are 3 primary layers of control for internet and app access- 1) wifi network controls such as firewalls 2) device controls such as guest accounts and location permissions 3) account controls such as allowed and blocked websites and apps.
These work in order - if a network blocks a certain website, device and account controls cannot override the network and allow that website. Conversely, if a device allows guest accounts, account controls can be bypassed by using the guest account instead. This page will cover these 3 layers in detail.
Network Controls
Before any internet traffic reaches a device, it goes through the wifi network it’s connected to. Possible networks include school, home, cellular, and public (e.g. Starbucks) networks.
| Controller | Control Method | |
|---|---|---|
| School Wifi | UPrep | Professional Firewall |
| Home Wifi | Family | Router Settings |
| Cellular | Family | Cell-Provider Parental Controls |
| Public Wifi | None | None |
UPrep Network Controls
UPrep wifi settings are owned by IT. We use Category Filter through the firewall. If you require a list of content types that are blocked, reach out to IT.
Home and Cellular Network Controls
Internet access on home networks, cell phones, or through cell phone tethering is managed by controls on each such network. Each wifi device and cellular provider has different capabilities regarding access control. Please refer to your manufacturer or cell provider for more information.
Public Networks
Unless a device is locked to only certain known networks (like school and home), students may bypass school and home networks by using a public network at a coffee shop or other location.
Network Back Door (VPN)
Technical users (including some students) can get around school or home network controls by using a Virtual Private Network. VPNs provide a ‘tunnel’ through a firewall, where traffic is encrypted and invisible to the firewall. A firewall can only see the VPN, not what sites are being accessed through it. UPrep IT does not block VPNs.
Recommendations for Network Controls
Networks outside UPrep should be restricted to meet the families needs. A combined approach of blocking adult content and distracting content at the network and device account level (see below) is recommended for optimum protection.
Device Controls
Once internet traffic passes through the network layer, it reaches the device itself. This second layer of control manages the physical capabilities of the Chromebook or computer, regardless of who is logging into it. Common device-level settings include permission for guest accounts and location services.
Family-Owned Devices
Most student Chromebooks and other devices at UPrep are owned by the student’s family. For Chromebooks, the first account created on the device is the ‘owner account’. This account has final control for all device settings, including disabling guest accounts. If a family sets up a Chromebook using a parent account before giving the device to the student, the parent can manage device settings. If the family gives the Chromebook to the student to set up first, the student has full control of the device, and can create secondary accounts outside parental controls or simply use the Guest account built into Chromebook.
Recommended Controls
- Ensure a parent is the first user to log in to a new Chromebook. This makes
them the device ‘owner’.
- If a current account has a student as the first user, the device must be
factory reset and then set up as new with a parent as the owner. Be sure to
save all important information in the cloud or a local hard drive before
doing this.
- Factory reset the Chromebook to remove the student account as primary
- Setup the Chromebook using a parent’s account
- If a current account has a student as the first user, the device must be
factory reset and then set up as new with a parent as the owner. Be sure to
save all important information in the cloud or a local hard drive before
doing this.
- Disable the guest account and the ability to create new accounts (instructions)
- Add the student’s gmail account, then add their UPrep account using the
instructions under Google Family Link (see below). It
is critical that the UPrep account is added as a secondary account to the
student account, not as its own account.
- For more information, see the Google Help page
- Consider disabling access to unknown networks, which removes the public network back door, but also makes it harder for students to work outside school/home.
Loaner Devices
UPrep has loaner devices available for checkout. For loaner devices, the school manages device controls through the onsite firewall. Loaners are not intended for long term use or extensive use off campus. Students should return borrowed devices the same day unless a longer loan period is required because a student’s device is damaged or not functioning. Arrangements should be made with the IT department to extend the time frame of the loaner device. Families are expected to repair/replace student devices in a timely manner.
Account Controls
On Chromebook and Chrome browser, the logged in user may have specific abilities depending on their account type and the controls set up on that account. Accounts can be Google accounts, UPrep accounts, or guest accounts. Google and UPrep accounts can be further separated into adult and child accounts. Personal Google accounts are considered “adult” accounts unless they are under parent controls.
| Parental Controls | UPrep Controls | ||
|---|---|---|---|
| Child Google Account | *@gmail.com | Google Family Link | None |
| Adult/Default Google Account | *@gmail.com | None | None |
| Child UPrep Account | *@universityprep.org | Some via Google Family Link if secondary to gmail account | Yes |
| Adult UPrep Account | *@universityprep.org | None | Yes |
| Guest Account | None | Device controls only | Device controls only |
As you can see, this is a somewhat complex matrix. The key points are:
- For Gmail accounts, UPrep has no control. Parental controls must be enabled with Google Family Link (see below).
- For UPrep accounts, UPrep has primary control. Parental controls still apply when the account is part of Family Link, but can be bypassed for school-required apps to force install those apps on every Chromebook with a UPrep account.
- For Guest accounts, there are few controls, so Guest accounts should be disabled by the device owner. To enforce this, a parent must be the first person to use a Chromebook.
Google Family Link
Parental controls for Chromebook and Chrome browser are managed in Google Family Link. They work at the account level, so the device must also be ‘owned’ by a parent (see Device Controls above). Otherwise account controls can easily be avoided by using a separate account.
To allow parents some control over school accounts, add the school account in Google Family link using Google’s instructions. It is critical that the UPrep account is added as a secondary account to the student account, not as its own account.
UPrep does not have recommendations for parental controls. Each family should decide what’s best for them.
Blocking School-Required Apps
If parental controls block apps that are required by classes, those apps cannot be installed by the student without the parent entering their password to install them. They can, however, usually be installed for all students at the same time by the school. If there are issues with installing school-required apps, we will reach out to the parents to allow them.