Chromebook Rules
Every setting UserAuthGuard pushes onto student Chromebooks, on one page: what it does, who it applies to, and whether it took. Written through Google’s Chrome Policy API to the OUs, schools or grades you choose.
What it does
The Google Admin console can do almost anything to a Chromebook, spread across hundreds of settings and dozens of OUs, with no page that says what you have actually turned on for whom. Chromebook Rules is that page, for the settings districts ask for most.
Each rule is a named Google policy UserAuthGuard writes for you through the Chrome Policy API. School Wi-Fi only restricts devices to district networks, set by school or grade, so take-home policy can differ by age. Turn off Chrome’s built-in AI switches off Gemini in Chrome, Help me write, Lens and the related features in one step rather than a dozen. Overnight lock is Active Device Hours. Sign-in screen puts the owner’s name, the serial and a return code on the device before anyone signs in. Alongside those, the filtering settings can push SafeSearch and YouTube Restricted Mode, camera and microphone access, screen capture, incognito and guest mode to the OUs you pick.
Every rule shows who it applies to and where it stands: on, off, synced, or failed with the reason. Rules target organizational units, because that is what Google policy attaches to; UserAuthGuard maps your schools and grades to OUs so you can think in those terms. A rule changes nothing until you turn it on, and Google’s own console remains the authority for everything not listed here.
- ✓ School Wi-Fi only, by gradeChromebooks connect only to district networks, so they do not work on home Wi-Fi. Set per school or grade; leave older students unrestricted if that is the policy.
- ✓ Chrome’s built-in AI offGemini in Chrome, Help me write, Help me read, Lens, tab organizer and related features switched off in one rule.
- ✓ Safety settings pushed to OUsSafeSearch and YouTube Restricted Mode, camera and microphone, screen capture, incognito and guest mode, written to the target OUs you choose.
- ✓ Owner on the sign-in screenA sign-in wallpaper per device naming its student, with the serial and a return code.
- ✓ Status, not hopeEach rule reports whether Google accepted it, per OU, and flags failures so a quota error or a permissions gap is visible the same day.
Requires
- The Enterprise plan, and UserAuthGuard authorized to write Chrome user and device policy for your OUs.
- Students and devices in OUs that map to your schools and grades. The 1:1 assignment OU structure gives you this.
Does not
- Replace the Admin console. These are the rules UserAuthGuard manages; every other Chrome setting stays where it is.
- Push arbitrary policies. Each rule is a specific, named setting, listed on the page. If it is not listed, UserAuthGuard does not write it.
- Block sites by category. Content filtering by category and by site is Blocked Content, on the Enterprise Plus plan.
- Target an individual student. Google policy attaches to OUs; per-device OUs give per-device granularity for device settings, user settings follow the user’s OU.
Where it fits
Take-home policy by age
Elementary devices restricted to school Wi-Fi so they are classroom tools; middle and high school allowed home networks for homework. One rule, set per school.
The board asks about AI in Chrome
Turn the rule on and Gemini in Chrome, Help me write and the rest are off for every student OU, with a page that shows it took. Turn it back on for a pilot group by OU when the policy changes.
A rule quietly failed
Google rejected a policy write for one OU during a quota spike. The rule’s status shows the failure and the OU, so it is retried that day, not discovered in a parent complaint.
Frequently asked questions
How does this interact with settings we already have in Google Admin?
Each rule writes one specific policy to the OUs you target. Settings you set yourself on other OUs, or other settings on the same OU, are not touched. If you change a rule’s setting by hand in the console, the console wins until the rule is next applied, so make rule changes here.
Can a student turn a rule off?
No. These are Google-managed Chrome policies, enforced by ChromeOS on an enrolled device. They are not extension settings and cannot be changed from the device.
How quickly does a change apply?
UserAuthGuard writes the policy immediately. Devices pick up user policy at the next policy refresh, typically within minutes while online; Google allows up to 24 hours for device policy.
Is the sign-in screen rule the same as the 1:1 sign-in restriction?
No. The sign-in restriction is what stops other accounts signing in; it is part of 1:1 Device Assignment. The sign-in screen rule is the wallpaper that names the owner so a found device can be returned. They work together but are separate.
See what is pushed to every Chromebook
Chromebook Rules are part of the Enterprise plan, priced per student, à la carte. Start free first: your whole OU tree, and the gap report listing every device with no owner and every student with no device.