UserAuthGuard gives every Chromebook its own Google sign-in lock, assigned to one student and kept current as devices change hands. You always know who has each device, and who had it before.
Built on Google Admin’s own Sign-in restriction. A student who isn’t assigned to a Chromebook gets Google’s error at the sign-in screen. There’s no app on the device to tamper with.
UserAuthGuard creates one OU per device, named by serial, inside your Assigned OU. Policy is inherited; only the allowed student is per device. Reassign, and the lock moves with it.
Connect Google Admin free and see every device and every assignment gap. Turn the lock on when you’re ready.
Or host a 30-minute lunch-and-learn for your IT team.
No credit card required · FERPA & COPPA Compliant · Works with Google Admin
Every Chromebook opens for exactly one student — the one it’s assigned to — so you always know who is responsible for it, and who was before.
Google Admin › Devices › Chrome › Settings › Device settings › Sign-in restriction › “Restrict sign-in to a list of users”. Per Google: “Only users that you designate can sign in to devices. Other users get an error message.”
Device settings apply to an organizational unit. Giving one Chromebook to one student means that Chromebook needs its own OU with that student listed — thousands of OUs, edited by hand, and redone at every swap. That’s why almost no district does it.
For each assigned device it creates an OU named by the device’s serial inside a parent Assigned OU, sets the allowed user to the assigned student, and moves the device in.
Every device OU inherits the parent’s filtering, apps and network settings. Only the allowed user is local to the device. Google Admin labels these settings Inherited or Locally applied, so you can see which is which.
Reassign, swap or return a device and UserAuthGuard updates the allowed user. The district always knows who has each device, and who had it before.
Google Admin’s Sign-in restriction can limit a Chromebook to named users, but it’s set per OU, so real 1:1 enforcement means one OU per device. UserAuthGuard automates that: assign a device and it creates an OU named by serial under a parent Assigned OU, sets the allowed user to that student, and moves the device in. Everything else is inherited from Assigned, so you still manage policy in one place. Reassign or return the device and the allowed user updates, with a dated history. Enforcement happens at Google’s own sign-in screen, so there is no agent on the device to tamper with. Keep guest mode and managed guest sessions off, because Google notes those bypass the restriction. Changes usually apply within minutes but Google allows up to 24 hours.
Google Chrome Enterprise Help: Set ChromeOS device policies — Sign-in restriction →
| What districts are usually sold | What it records | Stops another student signing in? | Who’s accountable when it’s lost |
|---|---|---|---|
| Paper sign-out sheet or note | A name next to a serial number | No | Whoever the sheet says, if it’s current |
| Spreadsheet or asset tracker | Serial-to-student rows in a database | No — the Chromebook never knows | Whoever the record says; it drifts |
| Barcode check-in / check-out | Scanned hand-offs at a desk | No, not between hand-offs | The last person scanned |
| Locate-and-recover after loss | Where a device went after it went missing | No — it acts after the fact | Unknown until recovered |
| UserAuthGuard per-device sign-in lock | The assignment, enforced by Google at sign-in | Yes — only the assigned student | The assigned student, with prior holders on record |
Categories only. No vendor is named, and no claim is made about any specific product.
Every district sits somewhere on this line. Most are stuck in the first two stages and can’t put a number on what it’s costing them. The leaders have moved.
Device loss isn’t a kid problem — it’s a governance gap. You can’t fix what you can’t see, and a spreadsheet can’t see it.
Device identity becomes the policy. Each Chromebook is bound to its own OU, so accountability comes from Google Workspace enforcing it rather than from watching anyone.
Every device accounted for, every assignment audit-logged, every loss investigated. The refresh budget stops leaking.
Each Chromebook gets its own organizational unit, bound to one student. Move the device, the policy follows. Lose the device, the audit trail is already there. No spreadsheets, no rolodex of who-has-what.
Pick your seat. See what changes day one.
Real-time inventory synced with Google Admin. One-click lost mode. Full device accountability.
Device identity enforcement, 1:1 assignment, automated compliance, and OU-level security.
Three steps from deployment to automated compliance.
Each Chromebook is assigned a dedicated Organizational Unit in Google Workspace. The device's identity becomes its security policy — no user action required.
OU-Lock enforces security policies at the Google Workspace level. Filtering rules, app restrictions, and network policies stay applied — even if someone tries to move the device.
Whoever has the device gets the correct security policies, with no manual configuration per user. Compliance without trusting people to do it.
OU-Lock secures devices at the Google Workspace layer, so the security model does not depend on watching what a student does.
Stages 3 and 4 aren’t a dashboard you buy — they’re a loop you run. This is the loop: check device health, run the campaign, keep students engaged in caring for their own device.
Students walk a guided self-check each month — keyboard, screen, speaker, battery — and earn points and streaks for keeping their device healthy. Honest damage reports are rewarded, not punished, and it does not start with an IT ticket.
Push a refresh or return campaign to any group — a school, a grade, a serial list — across a date window. It escalates on its own: silent reminder → notification → banner → lock, until every device is checked in or accounted for.
Points, streaks and milestones turn device care into something students actually do — clean returns, on-time checks, honest reporting. Optional Enterprise screen-time analytics are admin-only and opt-in.
At 2024 prices · $400 a device
per year
At today's prices · $650 a device
per year
The same number of lost devices now costs you
a 63% increase — and nothing about your loss rate changed
What the audits actually found
Chicago spent $2.6 million a year on services that freeze and geo-track devices. In the year ending June 2022 they recovered eleven. Tracking a device after it goes missing is not the same as knowing who had it.
Education Chromebooks went from about $400 to over $600 a unit inside a year — memory makers shifted capacity to high-bandwidth memory for AI data centers, and the shortage hit the cheapest devices hardest. Upper Darby School District told WHYY in August 2026 it now pays over $600 and spends $2–3 million a year on replacements.
Verbatim quotes from customers. We don’t attach before/after numbers they didn’t give us.
“UserAuthGuard has saved our team several hours each week by eliminating the need to manually investigate device usage and ownership in Google Admin logs.”
“I would absolutely recommend UserAuthGuard to other districts. If you need to keep track of your devices and you’re using Google Admin, it’s a no-brainer.”
The full four-stage model, a five-question self-assessment, and the concrete moves between each stage — the same framework on this page, in a one-pager you can take to a board meeting.
How districts move from reactive recovery to active stewardship — and what it takes.
UserAuthGuard is a Chromebook management platform built for K-12. It provides 1:1 device assignment, real-time tracking, instant lost mode, check-in/check-out, and visual Google OU management. A Chromebook that is not assigned to the student holding it cannot be signed into at all.
Each Chromebook gets a dedicated OU and is linked to a specific student. Our patent-pending OU-Lock ensures clear accountability — students know which device is theirs, IT can track who has what. Assignment takes seconds.
UserAuthGuard syncs with Google Admin in real-time. When a device goes missing, activate lost mode with one click — it displays a recovery message with your school's contact info. See the assigned student and last sync time instantly.
It tracks when students receive and return devices. Scan a barcode, assign to a student, and the system records the full history. At year-end, check devices back in with a complete audit trail of who had each device and when.
With UserAuthGuard's Visual OU Explorer, select multiple devices, click "Move to OU," and choose your destination. What takes 30+ minutes in Google Admin Console takes 30 seconds with bulk OU management.
Clear 1:1 assignment means students know they're responsible for their specific device. Real-time tracking, instant lost mode, and visible checkout history create accountability. And a device that is not assigned to the student holding it cannot be signed into.
Yes. UserAuthGuard is free to see your whole fleet — read-only visibility of every device, user, and OU, plus assignment-gap reporting. No device cap, free forever, no credit card. Blocking, enforcement, and classroom monitoring are paid modules, priced à la carte.
Complete asset tracking: warranty status, repair history, assignment records, and fleet analytics. Sync your entire fleet from Google Admin, see which devices need attention, and generate audit reports — all in one dashboard.
Security policies enforced by device identity, not user trust or installed agents. UserAuthGuard's patent-pending OU-Lock binds each Chromebook to a dedicated Google OU. Nothing to install, nothing to tamper with, nothing for IT to maintain per device.
Filters monitor what students do. UserAuthGuard secures the devices themselves — who has them, where they belong in your OU structure, and that policies stay applied. They're complementary. Many districts run both together.
OU-Lock itself secures devices through Google Workspace organizational units rather than software on the device. Classroom and safety are separate, paid, and do use a Chrome extension — a district switches them on deliberately.
For districts that want visibility, UserAuthGuard offers a classroom and safety extension — a paid add-on, priced à la carte, with real-time classroom screen view, screen time analytics, content blocking, and keyword alerts. It deploys via Google Admin and only runs during school hours. This is entirely separate from the core platform.
Connect Google Admin and see every device, every assignment gap, and what it's costing you a year — free forever. Pay only to enforce it.
See your whole fleet free — every device, every gap, the yearly cost. No credit card. Pay only to enforce it.
See your whole fleet free • No credit card required • Works with Google Admin
