Google Admin Console Settings: Best Practices for Education

The Google Admin console can seem daunting at first, but we hope that these helpful tips and tricks will ease your worries. Most people aren’t aware of the capabilities of the Admin console, so we created a list of best practices for user and device settings for schools. Although all of these settings are up to your discretion, we hope our recommendations help you efficiently manage your classroom or school and ensure you are getting the most out of your Chrome devices.

Related: gPanel, an enterprise-class administration console

User Settings

The User settings section of the Admin console allows you to manage user-based settings on the Chrome browser and Chrome devices. To navigate to User settings from the Admin console homepage click on Device Management > Chrome Management > User settings.

Apps & Extensions

By default, users can download any type of Chrome web app or extension they want. This setting allows you to block students and teachers from installing certain types of apps. Your admin can also choose which apps and extensions are force-installed. We recommend having the admin pick which specific apps and extensions they would like students and teachers to have access to, and block the rest. For example, if a teacher wants to block students from using the preset calculator app during a test, an admin can do that here. Make sure to have your admin check the reviews on the extension before adding it because some extension makers will spam the user.

Admin console apps and extensions settings Admin console force installed apps settings Admin console allow or block all apps and extensions

You can find out more about the different types of apps and extensions here: Extensions, Theme, Google Apps Script, Hosted App, Legacy Packaged App, and Chrome Packaged App.

Incognito Mode

This setting determines if students can use Incognito Mode on Chrome. Setting this policy to “Disallow Incognito Mode” prevents users from opening new incognito windows. We recommend disabling this so that you are able to monitor student activity.

Admin console incognito mode settings

Browser History

This setting controls whether Chrome saves a student’s browsing history or if students can clear browser data, including their viewing and download history. We recommend updating the settings to save browser history and disable clearing history so admins can ensure students are staying on track.

Admin console browser history settings

Safe Browsing

This setting controls if Safe Browsing is turned on for students. Safe Browsing in Chrome helps protect users from websites that may contain malware or phishing. We recommend always enabling Safe Browsing for students and teachers.

Admin console Safe Browsing settings


This sets whether websites are allowed to track a student’s physical location. We recommend that you deny geolocation so a student’s whereabouts are never shared or tracked.

Admin console geolocation setting

Safe Search and Restricted Mode

This setting specifies whether Google Safe Search or YouTube Restricted Mode is turned on for users. We recommend that you change this setting to always use Safe Search for Google Web Search queries and that you enforce at least Moderate Restricted Mode or Strict Restricted Mode on Youtube so that students can’t watch inappropriate videos.

Admin console safe search and restricted mode settings

URL Blocking

This setting prevents Chrome browsers from accessing specific URLs. To configure the policy, enter up to 1,000 URLs on separate lines. Each URL must have a valid hostname (such as, an IP address, or an asterisk (*) in place of the host. The asterisk is a wildcard, representing all hostnames and IP addresses. We recommend blacklisting inappropriate or distracting URLs so students stay focused.  For example, to block users from accessing Facebook, type in in the text box.

Admin console URL blocking settings

Managed Bookmarks & Bookmark Bar

This setting allows you to push a preset list of bookmarks to users on Chrome on desktop and mobile devices. These bookmarks will appear in a folder on Chrome’s bookmark bar. You may want to create bookmarks for your school’s online portal or different websites your students will use often. We recommend enabling the bookmark bar and disabling bookmark editing so that students can’t delete or change the bookmarks you choose.

Admin console bookmark settings Admin console manage bookmark settings

Video Input

This setting specifies whether websites can access a built-in Chrome webcam.  We recommend you disable video input so that your students can’t use the webcam. However, this does not disable the webcam for Google voice and video chat. To disable the webcam for Google voice and video chat, use the Allowed Apps and Extensions setting in User settings to block the following extension: hfhhnacclhffhdffklopdkcgdhifgngh.

Admin console video input settings

Device Settings

To navigate to Device settings from the Admin console homepage, click on Device Management > Chrome Management > Device settings.

Forced Re-enrollment

Forced re-enrollment ties the device to your domain no matter what. By default, this is set to “Force device to re-enroll into this domain after wiping”. To turn this off, select “Device is not forced to re-enroll after wiping”. This prevents students from wiping the device and enrolling it into a new domain.

Admin console forced re-enrollment settings

Disabled Device Return Instructions

This setting controls the custom text on the disabled device screen. We recommend you include a return address and contact phone number in your message so that users who see this screen are able to return the device to your school.

Admin console disabled device return instructions

Guest Mode

This setting controls whether guest browsing is allowed on managed Chrome devices. If you select “Allow guest mode” (the default), the main sign-in screen lets a person sign in as a guest. If you select “Do not allow guest mode”, a user must sign in using a Google Account or G Suite account. When a user signs in using guest mode, your organization’s policies are not applied, so we recommend turning this setting off.

Admin console guest mode settings

Restriction

This setting lets you control which users have permission to sign in to a managed Chrome device. Its default is to Restrict Sign-in to list of users is selected. If the textbox is left empty, any user with a Google Account or G Suite account can sign in. However, if you include a list of usernames (domain email separated by commas) in the text box, only the named users can sign in. We recommend filling out the textbox with the wildcard * so that only users within your domain can sign-in. This will restrict students from signing in with personal accounts.

Admin console sign-in restrictions settings

Device Reporting

This setting is on by default and specifies if Chrome devices enrolled in your domain report their current device state. Go to Device management > Chrome > Devices and click on the device’s serial number to see its details. You can also track recent device users by clicking on the device in your Admin console under Device management > Chrome > Devices > Device Serial Number > Recent Activity. This ensures that you receive reports on the device and can track its usage.

Admin console device reporting settings


The Google Admin console keeps you in charge of your school’s digital domain. With these tips, you’ll be able to quickly manage your students’ user accounts and devices, so you’ll have more time for what’s really important: educating the next generation.

Have more questions about the Admin console? Contact All Promevo customers receive free support and training.

Was this article helpful?