Category filter
Configure basic settings of managed guest sessions on ChromeOS devices
Managed guest sessions on ChromeOS provide a secure and controlled environment for users to access devices without the need to sign in with a Google account. It works well in places like libraries, computer labs in schools or colleges, testing centers, training facilities, co-working spaces, and other shared-use environments where users need temporary access to a device. With Hexnode UEM, IT administrators can easily configure and manage these sessions remotely, ensuring consistent policy enforcement, enhanced security, and a seamless user experience across all ChromeOS devices.
Note:
The Google Chrome app is added by default in Guest mode for ChromeOS devices.
Configure managed guest session settings
To configure managed guest session settings for ChromeOS devices via Hexnode,
- Login to your Hexnode UEM console.
- Navigate to the Policies tab and click on New policy to create a new policy, or modify an existing policy.
- Provide a suitable name and description (optional) for the policy.
- Navigate to ChromeOS > Managed Guest Session > Basic and click on Configure.
Basic Settings
Display name: Provide a display name for the managed guest session to be shown on the sign-in screen.
Add App: Use this option to select and install Chrome apps and Web apps to the device. The apps are available only during the particular guest session and are removed once the session ends. Click the +Add app icon. You can select from the following app types:
- Chrome Web Store apps:
Add a Chrome Web Store app using its name and App ID. To get the App details:
- Log in to the Google Admin Console.
- Go to Devices > Chrome > Apps & extensions.
- Click the + icon and choose the Chrome logo to open the Chrome Web Store.
- Select Top Chrome Apps to view supported apps.
- Choose your desired app and click Select in the top-right corner.
- You’ll be redirected to the Google Admin Console where the app and its 32-character App ID will be listed.
- Copy the App ID and App name, then paste them into the Hexnode console.
- Click Add. You can upload the managed configuration for the app in JSON format.
- Click Next. You can configure 3 options.
- Pin to toolbar: Enable the option to pin the app to toolbar.
- App Settings: You can configure the following app settings:
Setting Description Install type There are 3 options available: - Forced install: Force installs the app to the device.
- Allowed: Allow the user to manually install the application from the ChromeOS device.
- Forced install and pin to toolbar: Force installs the app and pins it to the toolbar.
Include in chrome webstore Specifies whether the Chrome application should appear in the Chrome Web Store collection. Override app installation URL This option allows admins to override the default installation URL for a Chrome app and use a custom URL instead. Override app installation URL This option allows admins to override the default installation URL for a Chrome app and use a custom URL instead. App installation URL (Available when Override app installation URL option is enabled.) Enter the custom URL for installing the Chrome app. - App permissions: Specify the permissions to be blocked/allowed by default for the selected application.
- Click Done.
- Web Apps:
Web apps added to Hexnode’s app inventory can be added to the device. Choose the desired app and click Select. You can configure 3 options.
- Pin to toolbar: Enable the option to pin the app to toolbar.
- App Settings: You can configure the following app settings:
Setting Description Install type There are 3 options available: - Forced install: Force installs the app to the device.
- Allowed: Allow the user to manually install the application from the ChromeOS device.
- Forced install and pin to toolbar: Force installs the app and pins it to the toolbar.
Launch web apps in There are 2 options available: - New tab: Launches the web app in a new tab.
- New window: Launches the web app in a new window.
General Settings
| Setting | Description |
|---|---|
| Auto launch managed guest session | Enabling this option automatically launches the managed guest session when the device starts up. |
| Auto-launch delay (Available when Auto launch managed guest session option is enabled.) | Enter the number of seconds to wait after the device starts up before automatically launching the managed guest session. |
| Screen rotation (Available when Auto launch managed guest session option is enabled.) | This setting controls whether users can rotate the screen and allows admins to enforce a fixed orientation on ChromeOS devices. The options are:
|
| Device health monitoring (Available when Auto launch managed guest session option is enabled.) | Enabling this option checks if the device is online and working properly. This can be viewed from Google Admin Console. |
| Session length limit | Specifies the length of time in minute(s) after which a user is automatically logged out, terminating the session. The user is informed about the remaining time by a countdown timer shown in the system tray. |
| Custom Terms of Use | Upload a custom text file (max 512 KB) to replace the default Terms of Use displayed during login. |
| Custom Avatar | Upload an image in JPEG format (max 512 KB) to replace the default avatar with a custom avatar. |
| Custom Wallpaper | Upload an image in JPEG format (max 512 KB) to replace the default wallpaper with a custom wallpaper. |
| QR code generator | f enabled, the Create QR Code feature in Google Chrome is enabled. |
Apps and extensions Settings
| Setting | Description |
|---|---|
| Chrome task manager | Specifies it the user can end processes with the Chrome task manager. |
| Manifest V2 extension | Specifies if the user can access Manifest v2 extensions on their Chrome browser. The options available are:
|
| URLs with extended background lifetime. | Enter a list of origins. This setting lets extensions keep running in the background if they are connected to a list – for example, if you add https://www.google.com, any extension using it will stay active as long as it’s connected. |
Session Settings
| Setting | Description |
|---|---|
| Show logout button | Enabling this option will show the Sign out button on the bottom taskbar (shelf) of the device, making it easier for users to log out during the session. |
| Logout confirmation dialogue | Enabling this option will show a dialog box asking the user to confirm or deny logout when the last window is closed. |
Startup Settings
| Setting | Description |
|---|---|
| Home button | This option specifies whether to show the Home button on Google Chrome’s toolbar. |
| Set homepage as new tab location | This setting controls which URL is used as the homepage on ChromeOS devices. There are 3 options available for this setting:
|
| Homepage URL (Available when Set homepage as new tab location option is set to False.) | Enter the URL that you want to set as the device’s homepage. |
| New tab URL | This text field specifies a URL for the new tab page and users can’t change it. |
| Show Google lens in new tab | This option specifies whether the Google Lens button is shown in the search box on the new tab page. |
| Action on startup | This option specifies what pages to load when users start their ChromeOS devices. The options are:
|
| Launch browser on startup | Enabling this option automatically launches Chrome browser when users start their ChromeOS devices. |
Kerberos Settings
| Setting | Description |
|---|---|
| Kerberos | If this option is enabled, ChromeOS devices can use Kerberos tickets to enable single sign-on (SSO) for internal resources that support Kerberos authentication. Kerberos authentication can be used to authenticate web apps and file shares. |
| Autocomplete Kerberos domain | This setting adds a prefilled domain to the Kerberos authentication dialog. If the user enters their username, it will be concatenated with the prefilled domain. Special characters are not allowed for this option. |
| Use custom pre-filled configs for Kerberos | Enabling this option allows admins to apply a custom Kerberos configuration. |
| Custom configuration | Enter the Kerberos configuration to be applied to managed guest sessions. |
Omnibox search provider Settings
| Setting | Description |
|---|---|
| Omnibox search suggest | This option allows admins to enable or disable a prediction service called Search Suggest in Chrome browser. The are 3 options:
|
| Google search side panel | Enabling this option allows Google Search Side Panel on any webpage in Chrome browser. |
Associate the policy with target entities
If you haven’t saved the policy,
- Navigate to Policy Targets.
- Select Domains/OUs.
- Click on +Add Domains/OUs.
- The Browse Domain/OU window will appear.
- From here, select the Google Workspace account that is integrated with Hexnode, (eg: example.kmanaged.com(Google))
- Next, locate the Parent OU, which is represented by a briefcase icon. Select the Parent OU to associate the policy with it, or
- Click the dropdown icon beside the Parent OU to expand and select the required Child OU(s).
- Once selected, click OK, then Save to apply the changes.
If you have already saved the policy,
- Navigate to Policies > My Policies and select the required policy.
- Click on Manage > Associate Targets.
- Select Domains/OUs.
- From here, select the Google Workspace account that is integrated with Hexnode, (eg: example.kmanaged.com(Google)).
- Next, locate the Parent OU, which is represented by a briefcase icon. Select the Parent OU to associate the policy with it, or
- Click the dropdown icon beside the Parent OU to expand and select the required Child OU(s).
- Click on Associate.
Note:
- If a child OU is selected, the policy will be associated with all the devices assigned to that particular child OU.
- If the parent OU is selected, the policy will be associated to devices assigned to all the child OUs.
Need more help?
