Skip to main content

Step 1 | Download configuration template

KB-artical-page-Windows.png

These instructions will guide you through preparing and enrolling your Windows 10 or 11 Pro/Education devices into the Mobile Guardian system for management. Administrators will use the created package across all devices per school. 

Enrolment Steps

Follow these steps to enrol your school devices and link them to the student from your Google Workspace Account.

Prerequisite:

Before beginning enrollment, ensure:

Deploy the Package

  • USB drive: Place the .ppkg file in the root of a USB drive; Windows will prompt to apply it on first boot
  • Double-click: run the  .ppkg on a device already at the Windows desktop
  • Imaging pipeline: embed the package in a Windows image or deployment task sequence

With this enrollment, web filtering is available. Added Restrictions will govern the device set on the active profile or policy added by the school admin on the active profile.

Step 1: Download configuration template

This Windows configuration applies to all schools in the district that don't have their own Windows configuration. A school with its own configuration uses that instead. Windows devices enrolled at the district move to the student's school when a student signs in.

  • Log in to your Mobile Guardian Dashboard.
  • Navigate to Windows MDM Settings

Student Identity Settings

  • Configure the following required parameters:
    • Identity Service: Google Workspace
    • Managed Browser: Google Chrome
      • Google Chrome is required for Google Workspace authentication.
    • Remove administrator rights from other accounts: Optional
    • Create the administrator account only when needed: Optional, only available if Remove administrator rights from other accounts is applied
    • Managed Browser Sign-In: Forced
    • Chrome Sign-in Pattern: Use your Google Workspace Domain

Windows Configuration Designer

  • Set basic profile settings for the template: (optional)
Clean PC
  • No 
  • Retain User Data
  • Clear User Data
Hide Windows interactive onboarding Requires an administrator or user account below, so there is an account to sign in with.
Create administrator account Enter User Name and Password.
Create user account Enter User Name and Password.
Rename device (Device-%SERIAL%) Renames Device to  Device-%SERIAL%
Prevent manual MDM removal Prevents the removal of the MDM.
Configure WiFi from default baseline profile Set the WiFi configuration on the Baseline profile for devices to automatically connect to when in range.

 

The following settings should be enabled to proceed with enrollment.

Install Google Chrome Adds the Chrome install to the package, so the managed browser is present before its policies apply. You download the Chrome Enterprise MSI and add it to the project folder.
Install Mobile Guardian extension Installs the extension in Google Chrome during provisioning, so it is ready at first sign-in instead of waiting for MDM policy.
Install Google Credential Provider for Windows (GCPW) Adds the GCPW install to the package. You still download the installer from Google and add it to the project folder.
Google domains allowed to sign in to Windows Sets the Google Credential Provider for Windows (GCPW) allowed domains. Leave empty to use your Google Workspace domain. Separate multiple domains with commas.
Retry enrollment if it fails Windows does not retry a failed enrollment, so a device provisioned without a network connection stays unmanaged. This schedules a retry that runs once the device can reach Mobile Guardian, and stops once enrolled.
Days to keep retrying enrollment How long a device keeps trying before it gives up, from 1 to 90 days. Leave empty for 14 days. Allow for devices that are provisioned and then stored before anyone switches them on.

 

  • Select Save and Download Configuration Template
  • Save the zip file to a USB drive along with the Chrome Enterprise MSI bundle and  Google Credential Provider for Windows (GCPW) files you previously downloaded.