Managing the Chromebook extension

To view the Chromebook extension's status and call details:

1. Log in to the device and ensure that it is connected to the Internet.

2. Open the Chrome browser and navigate to chrome://extensions.

   A list of configured extensions appears.

3. Click Options on the Absolute for Chromebooks extension.

The Absolute for Chromebooks Dashboard opens and shows the following device information:

• Identifier The unique Electronic Serial Number (ESN) assigned to the Secure Endpoint Agent that is installed on a device.: the unique Electronic Serial Number assigned to the installed extension
• Serial Number: the identification number assigned to the device by the device manufacturer

• Service Status: the status of the component manager portion of the Chromebook extension

  • idle: the component manager isn't doing any active work
  • running: the component manager is currently processing a call
  • stopped: the component manager hasn't yet started

It also shows the following information for each enabled policy:

• Policy: the name of the policy

• State: the status of the policy component portion of the Chromebook extension

  • idle: the policy component isn't doing any active work
  • running: the policy component is currently processing a call
  • stopped: the policy component hasn't yet started
• Last Scan: the last date and time (local device time A date and time expressed in a device's local time zone, as opposed to server time. In the console, local device time applies to usage data collected from devices, and the scheduling of some device action requests.) the policy was scanned on the device
• Last Report: the last date and time (local device time) the information scanned from the policy was reported to the Absolute Monitoring Center
• Next Scan/Report: the date and time (local device time) the policy is scheduled to be scanned on the device and the information is scheduled to be uploaded to the Absolute Monitoring Center

The Chromebook extension calls when the extension is loaded. If the call was unsuccessful, the Chromebook extension retries after 10 minutes, and then every 24 hours. You can trigger a call if you don't want to wait for the next scheduled call.

For example, you can trigger a call to:

• Activate a newly installed extension
• Test the extension's ability to make a call
• Download a new policy configuration from the console
• Download a device action, such as a Freeze request, submitted in the console

To trigger a call to the Absolute Monitoring Center:

1. Log in to the device and ensure that it is connected to the Internet.

2. Open the Chrome browser and navigate to chrome://extensions.

   A list of configured extensions appears.

3. Click Options on the Absolute for Chromebooks extension.
4. Click Force Agent Call.

The Chromebook extension calls in to the Absolute Monitoring Center. To verify the success of a test call, review the following fields:

• Last scan—shows the current date and time
• Last report—shows the current date and time

The Chromebook extension is only activated after your Google account is added to the Secure Endpoint Console and you select the OUs containing the devices that you want to add. This process enables Absolute to sync data from Google. The data is used to activate the Chromebook extension and supplement data reported by the Chromebook extension.

If the Chromebook extension is deployed to the device before the sync, the extension will retry after 10 minutes, and then again after 24 hours. Instead of waiting for the extension to retry, you can force the Chromebook extension to retry using one of the following methods:

• Sign out of the device and sign back in
• Reboot the device
• Remove the extension from the Organizational Unit (OU), wait for the device to remove the extension, and then add the extension back.

You can unenroll Chromebooks from Absolute by deprovisioning the devices in the Google Admin console. For information about deprovisioning Chromebooks, see the Google Admin console documentation.

When you deprovision a Chromebook device in the Google Admin console, Absolute retrieves the device's Deprovisioned status during the next scheduled sync of the device and does the following:

• unenrolls the device from Absolute

• sets Agent status to Disabled

• sets Chromebook > Extension to Disabled

• stops uploading information from the Chromebook extension to the Secure Endpoint Console

• stops syncing information between your Google account and the Secure Endpoint Console

Any existing data remains available in the console and can be viewed in reports by setting the Agent status filter to Disabled.

You can unenroll Chromebooks from Absolute by disabling the devices in the Google Admin console. For information about disabling Chromebooks, see the Google Admin console documentation.

When you disable a Chromebook device in the Google Admin console, Absolute retrieves the device's Disabled status during the next scheduled sync of the device and does the following:

• unenrolls the device from Absolute

• sets Agent status to Disabled

• sets Chromebook > Extension to Disabled

• stops uploading information from the Chromebook extension to the Secure Endpoint Console

• stops syncing information between your Google account and the Secure Endpoint Console

Any existing data remains available in the console and can be viewed in reports by setting the Agent status filter to Disabled.

If you re-enable the device in the Google Admin console, the device is re-enrolled and its data begins to sync again.

You can unenroll Chromebooks from Absolute by moving the devices to an unsynced OU. An unsynced OU is an OU that isn't selected on the Chromebook settings page of the Secure Endpoint Console.

To move devices to an unsynced OU:

1. Log in to the Google Admin console using the credentials for the account that you use to manage your devices.
2. From the Google Admin console home page, click Devices.
3. On the work area, click Chrome Devices.
4. On the navigation bar, search for and select the OU that contains the devices you want to unenroll.
5. In the Devices list, select the checkbox next to each device.
6. In the taskbar, click Move selected devices.
7. In the dialog that opens, select the unsynced OU you want to move the devices to and click Move.

During the next scheduled sync with your Google account, Absolute does the following:

• unenrolls the device from Absolute

• sets Agent status to Disabled

• sets Chromebook > Extension to Disabled

• stops uploading information from the Chromebook extension to the Secure Endpoint Console

• stops syncing information between your Google account and the Secure Endpoint Console

Any existing data remains available in the console and can be viewed in reports by setting the Agent status filter to Disabled.

You can unenroll Chromebooks from Absolute by deselecting the devices' OU in the Secure Endpoint Console.

All Chromebooks in the deselected OU are unenrolled from the Secure Endpoint Console.

To deselect an OU:

1. Log in to the Secure Endpoint Console as a user with Manage permissions for Policies.
2. On the navigation bar, click Settings > Chromebook settings.
3. Select the Google account that contains the Chromebooks that you want to unenroll.
4. In the work area, clear the selection for each OU that contains Chromebooks you want to unenroll. Clicking a parent OU that has the fully selected OU icon only deselects the parent OU. Clicking a parent OU that has the partially selected OU icon deselects the parent and the children. Initially, each account shows with the top level OUs. Click to expand an OU and see its children.
5. If a warning message appears, review the warning. If you previously selected Don't show me this again, the warning doesn't appear.
6. [Optional] If a warning message appears and you don't want to see the warning message again, click Don't show me this again. In this session and all future sessions, the warning will no longer appear. This has no effect on other users.
7. Click Unenroll.

During the next scheduled sync with your Google account, Absolute does the following:

• unenrolls the device from Absolute

• sets Agent status to Disabled

• sets Chromebook > Extension to Disabled

• stops uploading information from the Chromebook extension to the Secure Endpoint Console

• stops syncing information between your Google account and the Secure Endpoint Console

Any existing data remains available in the console and can be viewed in reports by setting the Agent status filter to Disabled.

Reselecting the OU re-enrolls its Chromebooks.

You can unenroll Chromebooks from Absolute by submitting an Unenroll Device request in the Secure Endpoint Console. For information on creating an Unenroll Device request, see Unenrolling devices from your account.

If you unenroll your Chromebooks using the Unenroll Device action, you will not be able to re-enroll your device without contacting Absolute Technical Support.

When the Unenroll Device request has been created, Absolute does the following:

• unenrolls the device from Absolute

• sets Agent status to Disabled

• sets Chromebook > Extension to Disabled

• stops uploading information from the Chromebook extension to the Secure Endpoint Console

Any existing data remains available in the console and can be viewed in reports by setting the Agent status filter to Disabled.

If you unenrolled a Chromebook by deprovisioning the Chromebook in the Google Admin console, you need to re-enroll the device in the Google Admin console.

For more information about re-enrolling Chromebooks in the Google Admin console, see the Google Admin console documentation.

The next time the device calls in, the device is re-enrolled. Absolute sets the device's Agent Status to Enabled and Chromebook > Extension to Installed.

If you unenrolled a Chromebook using the Google Admin console to move the Chromebook to an unsynced OU or using the Secure Endpoint Console to deselect the OU that the Chromebook belongs to, you can re-enroll the device by moving the device to an OU that is synced with the Secure Endpoint Console.

To move the device to an synced OU:

1. Log in to the Google Admin console using the credentials for the account that you use to manage your devices.

2. Navigate to Device Settings.

   1. From the Google Admin console home page, navigate to Devices.
   2. On the navigation bar, expand Chrome.
   3. On the navigation bar under Chrome, expand Settings.
   4. On the navigation bar under Chrome > Settings, click Device.
3. On the navigation bar, search for and select the OU that contains the devices you want to re-enroll.
4. In the Devices list, select the checkbox next to each device you want to re-enroll.
5. In the taskbar, click Move selected devices.
6. In the dialog that opens, select the synced OU you want to move the devices to and click Move.

The next time the device calls in, the device is re-enrolled. Absolute sets the device's Agent Status to Enabled and Chromebook > Extension to Installed.

If you unenrolled a Chromebook using the Google Admin console to move the Chromebook to an unsynced OU or using the Secure Endpoint Console to deselect the OU that the Chromebook belongs to, you can re-enroll the device by selecting the device's OU in the Secure Endpoint Console. If you use this method, make sure that both Device Settings and User & Browser Settings are configured for the OU and that the Chromebook extension has been deployed to the OU.

All Chromebooks in the selected OU are added to the Secure Endpoint Console.

To select the device's OU:

1. Log in to the Secure Endpoint Console as a user with Manage permissions for Policies.
2. On the navigation bar, click Settings > Chromebook settings.
3. Select the Google account that contains the OUs you want to select.

4. Select the checkbox next to each OU containing the Chromebooks you want to re-enroll. Selecting a parent OU also selects its children.

   Use one of the following methods to find the OUs you want to select:

   • To search for an OU, enter all or part of the OU name in the Filter Chromebook OU field. The results update dynamically as you type once you have entered at least two characters. The OU structure is maintained in the search and matching selections are highlighted.
   • To navigate the organizational structure to find the OU, scroll the page to find the item. Each account shows with the top level OUs. Click to expand an OU and see its children.

After two seconds, your changes are automatically saved.

Absolute schedules a sync with your Google account in 20 minutes time. The sync should take no longer than an hour. After the initial sync, Absolute schedules an automatic sync every 24 hours.

When the sync process is complete, the date and time are populated below the Google account on the Chromebook settings page. Chromebooks in the synced OU appear in the Secure Endpoint Console. Absolute sets the devices' Agent status to Active and Chromebook > Extension to Installed.

Last connected and Agent retain the values populated before the device was unenrolled. These values are updated when the Chromebook extension is deployed and the device calls in to the Absolute Monitoring Center.

When an authorized user logs in to the Chromebook, the extension is deployed to the device. The next time the device calls in, Absolute changes the device's Chromebook > Extension to Installed, updates Last connected, and sets Agent to the current version of the Chromebook extension deployed to the device.

To remove the Chromebook extension for all users in a particular OU:

1. Log in to the Google Admin console using the credentials for the account that you use to manage your users.

2. Navigate to Users & Browsers:

   1. From the Google Admin console home page, click Devices.
   2. On the navigation bar, expand Chrome.
   3. On the navigation bar under Chrome, expand Apps & extensions.
   4. On the navigation bar under Chrome > Apps & extensions, click Users & browsers.
3. On the navigation bar, search for and select the OU that you want to remove the Chromebook extension from.
4. Click the Absolute for Chromebook app and click .
5. Click SAVE.

The Chromebook extension is removed from the list of force-installed apps for all users in this OU. When an authorized user logs in to the Chromebook, the extension is removed from the device.

By default, when an OU is configured for force-installed apps, all authorized users within the OU receive all apps. To remove the Chromebook extension for a specific user you need to move the user out of this OU.

To help with the removal of the Chromebook extension for specific users, we recommend that you set up at least one OU that does not have the Chromebook extension configured as a force-installed app. You can name the OUs accordingly, such as "No Absolute Extension".

You can then move users between these OUs to manage the deployment of the Chromebook extension for individual users.

To remove the Chromebook extension from one or more authorized users:

1. Log in to the Google Admin console using the credentials for the account that you use to manage your users.
2. From the Google Admin console home page, click Users.
3. On the navigation bar, search for and select the OU that contains the users you want to update.
4. In the Users list, select the checkbox next to each user.
5. Click More > Change organizational unit.
6. In the dialog that opens, select the applicable OUs (for example, "No Absolute Extension") and click Continue.
7. On the User move confirmation dialog, click Change.

As the users log in to their Chromebooks, the extension is removed from each device.