Know who has every Chromebook. Because only they can sign in.
UserAuthGuard assigns each device to one student and has Google enforce it at the sign-in screen. Spares, loaners and devices out for repair carry their own state, so the record still matches the shelf in June.
Built on Google Admin’s own Sign-in restriction. A student who isn’t assigned to a Chromebook gets Google’s error at the sign-in screen. There’s no app on the device to tamper with.
UserAuthGuard creates one OU per device, named by serial, inside your Assigned OU. Policy is inherited; only the allowed student is per device. Reassign, and the lock moves with it.
Or host a 30-minute lunch-and-learn for your IT team.
No credit card required · FERPA & COPPA Compliant · Works with Google Admin
Google already has the lock. UserAuthGuard does the bookkeeping.
Every Chromebook opens for exactly one student, the one it’s assigned to, so you always know who is responsible for it, and who was before.
-
1
Google already has the lock
Google Admin › Devices › Chrome › Settings › Device settings › Sign-in restriction › “Restrict sign-in to a list of users”. Per Google: “Only users that you designate can sign in to devices. Other users get an error message.”
-
2
The catch: it’s set per OU
Device settings apply to an organizational unit. Giving one Chromebook to one student means that Chromebook needs its own OU with that student listed: thousands of OUs, edited by hand, and redone at every swap. That’s why almost no district does it.
-
3
UserAuthGuard does the bookkeeping
For each assigned device it creates an OU named by the device’s serial inside a parent Assigned OU, sets the allowed user to the assigned student, and moves the device in.
-
4
Policy stays in one place
Every device OU inherits the parent’s filtering, apps and network settings. Only the allowed user is local to the device. Google Admin labels these settings Inherited or Locally applied, so you can see which is which.
-
5
The lock follows the assignment
Reassign, swap or return a device and UserAuthGuard updates the allowed user. The district always knows who has each device, and who had it before.
Google Admin’s Sign-in restriction can limit a Chromebook to named users, but it’s set per OU, so real 1:1 enforcement means one OU per device. UserAuthGuard automates that: assign a device and it creates an OU named by serial under a parent Assigned OU, sets the allowed user to that student, and moves the device in. Everything else is inherited from Assigned, so you still manage policy in one place. Reassign or return the device and the allowed user updates, with a dated history. Enforcement happens at Google’s own sign-in screen, so there is no agent on the device to tamper with. Keep guest mode and managed guest sessions off, because Google notes those bypass the restriction. Changes usually apply within minutes but Google allows up to 24 hours.
Google Chrome Enterprise Help: Set ChromeOS device policies: Sign-in restriction →
Scroll the table sideways to see every column →
| What districts are usually sold | What it records | Stops another student signing in? | Who’s accountable when it’s lost |
|---|---|---|---|
| Paper sign-out sheet or note | A name next to a serial number | No | Whoever the sheet says, if it’s current |
| Spreadsheet or asset tracker | Serial-to-student rows in a database | No, the Chromebook never knows | Whoever the record says; it drifts |
| Barcode check-in / check-out | Scanned hand-offs at a desk | No, not between hand-offs | The last person scanned |
| Locate-and-recover after loss | Where a device went after it went missing | No, it acts after the fact | Unknown until recovered |
| UserAuthGuard per-device sign-in lock | The assignment, enforced by Google at sign-in | Yes, only the assigned student | The assigned student, with prior holders on record |
Categories only. No vendor is named, and no claim is made about any specific product.
Three moves from write-off to stewardship
-
The cost
Name the problem
Device loss isn’t a kid problem, it’s a governance gap. You can’t fix what you can’t see, and a spreadsheet can’t see it.
-
The mechanism
Name the solution
Device identity becomes the policy. Each Chromebook is bound to its own OU, so accountability comes from Google Workspace enforcing it rather than from watching anyone.
-
The win
Name the outcome
Every device accounted for, every assignment audit-logged, every loss investigated. You can answer who had it, and when.
Assignment is one screen. The rest hangs off it.
Search a student, search a device, assign. UserAuthGuard writes the OU, sets the allowed user and records who had the device before. Every feature below works from that one record.
- Per-device sign-in lock. One OU per device, named by serial, with policy inherited from your Assigned OU.
- Bulk assignment from a CSV. Serial and student per row. Spares, loaners and devices out for repair carry their own state.
- Check-in and check-out. A QR code on each device for the front office, and every hand-off dated.
- Chain of custody. Who has it now, who had it before, and when it changed hands.
- Lost mode. Mark a device lost and it shows a return message with your contact details. You already know who had it.
- End-of-year return. Scan devices back in, match each to its student, note chargers and condition, and see what is still out.
Where is your district right now?
Every district sits somewhere on this line. Most are in the first two stages and can’t put a number on what it’s costing them.
Reactive Recovery
Spreadsheet Tracking
Active Stewardship
Accountable Fleet
What the same losses cost you now
At 2024 prices · $400 a device
per year
At today's prices · $650 a device
per year
The same number of lost devices now costs you
a 63% increase, and nothing about your loss rate changed
What the audits actually found
- Chicago Public Schools: 77,505 devices reported lost or stolen in 2021–22, original price over $23 million. The district's Inspector General put it at 11% of its devices and called it “alarming.” After the report, more than 11,800 turned up. They were unaccounted for, not gone.
- Centralia School District, Washington: the State Auditor's 2025 report found nearly 1,000 Chromebooks unaccounted for, worth close to $300,000. Auditors asked the district to produce 20 specific devices; it could not find 11 of them.
- In a Frontline Education poll of 26 school business and technology leaders, more than half put annual device loss at 6% or higher.
Chicago spent $2.6 million a year on services that freeze and geo-track devices. In the year ending June 2022 they recovered eleven. Tracking a device after it goes missing is not the same as knowing who had it.
Education Chromebooks went from about $400 to over $600 a unit inside a year. Memory makers shifted capacity to high-bandwidth memory for AI data centers, and the shortage hit the cheapest devices hardest. Upper Darby School District told WHYY in August 2026 it now pays over $600 and spends $2–3 million a year on replacements.
Stages 3 and 4 are a routine, not a purchase
The lock gives every device a name. Keeping the record true through a school year is a loop: check device health, run the sweep, and give students a reason to look after the device that is theirs.
Monthly health checks, run by students
Students walk a guided self-check (keyboard, screen, speaker, battery) and earn points and streaks for keeping their device healthy. An honest damage report earns credit instead of a ticket.
Schedule a sweep. It escalates until it’s done.
Push a refresh or return campaign to any group (a school, a grade, a serial list) across a date window. Reminders escalate on their own, up to a lock on the device, until every device is checked in or accounted for.
Students engage because it’s theirs
Points, streaks and milestones reward the things that keep a fleet whole: clean returns, on-time checks, honest reporting. The student sees their own score and nothing else.
Real districts, in their own words
Verbatim quotes from customers. We don’t attach before/after numbers they didn’t give us.
“UserAuthGuard has saved our team several hours each week by eliminating the need to manually investigate device usage and ownership in Google Admin logs.”
“I would absolutely recommend UserAuthGuard to other districts. If you need to keep track of your devices and you’re using Google Admin, it’s a no-brainer.”
Get the Device Stewardship Maturity Model
The full four-stage model, a five-question self-assessment, and the concrete moves between each stage: the same framework on this page, in a one-pager you can take to a board meeting.
Questions districts ask
The lock, the free plan, and what the product deliberately does not do.
What is UserAuthGuard?
Device management for K-12 districts on Google Workspace. It assigns each Chromebook to one student and has Google enforce that at the sign-in screen. Around that assignment it keeps the record: who has each device, who had it before, check-in and check-out, lost mode, and end-of-year return.
How does the per-device sign-in lock work?
Google Admin’s Sign-in restriction can limit a Chromebook to named users, but it is set per organizational unit. UserAuthGuard gives each assigned device its own OU under a parent Assigned OU, names the student as the allowed user and moves the device in. Filtering, apps and network settings are inherited from the parent, so you still manage policy in one place.
What happens when another student tries to sign in?
They get Google’s own error at the sign-in screen and no session starts, so there is nothing on the device to work around. Keep guest mode and managed guest sessions off; Google documents that those bypass the restriction.
What happens when a device is reassigned, swapped or returned?
The allowed user updates with it, and the previous holder stays on the record with dates. Spares, loaners and devices out for repair carry their own state, so the record matches what is on the shelf.
Is there a free plan?
Yes. Connecting Google Admin and seeing your whole fleet is free: every device, user and OU, plus assignment-gap reporting, with no device cap and no credit card. Enforcement is paid, priced per student, à la carte, alongside flat-priced bulk utilities and a separate classroom and safety extension. See pricing.
Does UserAuthGuard replace GoGuardian or Securly?
No. Filters govern what a student can do once signed in. UserAuthGuard decides who can sign in at all and keeps the record of who has the device. The two work side by side.
Does UserAuthGuard monitor students?
The core product does not. The lock is a Google Workspace setting, not software on the device, and the device record holds assignments, not activity.
Classroom and safety tools (live classroom view, content blocking, keyword alerts) are a separate paid extension, deployed through Google Admin, that a district turns on deliberately.
How does UserAuthGuard handle lost Chromebooks?
Mark a device lost and it shows a return message with your contact details. Because the device was assigned to one student, you already know who had it, and the chain of custody shows who had it before.
Does it handle inventory, repairs and end-of-year return?
Yes. Each device carries its assignment history, warranty status and repair tickets. At the end of the year, scan devices back in, match each to its student, note chargers and condition, and see what is still out.
Connect Google Admin and see every device and every assignment gap. No credit card. Pay only to enforce it.
Ready to make every Chromebook open for one student?
No credit card · FERPA & COPPA · No agent to install · Works with Google Admin