These instructions will guide you through preparing and enrolling your Windows 10 or 11 Pro/Education device on the Mobile Guardian system for management. School Administrators will use the created package across all devices per school.
Enrollment Steps
Follow these steps to enrol your school devices and link them to the student from your Google Workspace Account.
Prerequisite:
Before beginning enrollment, ensure:
-
Students: Your Google Workspace infrastructure is linked, and users are fully synced to the Mobile Guardian Dashboard.
- Click here to view
- Download: The 64-bit Chrome Enterprise MSI bundle from https://chromeenterprise.google/download/?modal-id=download-chrome#windows-download
- Download: Google Credential Provider for Windows (GCPW): download the 64-bit standalone installer from https://tools.google.com/dlpage/gcpw/
- Access to Windows Configuration Designer
Deploy the Package
- USB drive: Place the .ppkg file in the root of a USB drive; Windows will prompt to apply it on first boot
- Double-click: run the .ppkg on a device already at the Windows desktop
- Imaging pipeline: embed the package in a Windows image or deployment task sequence
With this enrollment, web filtering is available. Added Restrictions will govern the device restrictions set on the active profile or policy added by the school admin on the active profile.
Step 1: Download configuration template
- Log in to your Mobile Guardian Dashboard.
- Navigate to Windows MDM Settings
Student Identity Settings
- Configure the following required parameters:
- Identity Service: Google Workspace
-
Managed Browser: Google Chrome
- Google Chrome is required for Google Workspace authentication.
- Remove administrator rights from other accounts: Optional
- Create the administrator account only when needed: Optional, only available if Remove administrator rights from other accounts is applied
- Managed Browser Sign-In: Forced
- Chrome Sign-in Pattern: Use your Google Workspace Domain
Windows Configuration Designer
- Set basic profile settings for the template: (optional)
| Clean PC |
|
| Hide Windows interactive onboarding | Requires an administrator or user account below, so there is an account to sign in with. |
| Create administrator account | Enter User Name and Password. |
| Create user account | Enter User Name and Password. |
| Rename device (Device-%SERIAL%) | Renames Device to Device-%SERIAL% |
| Prevent manual MDM removal | Prevents the removal of the MDM. |
| Configure WiFi from default baseline profile | Set the WiFi configuration on the Baseline profile for devices to automatically connect to when in range. |
The following settings should be enabled to proceed with enrollment.
| Install Google Chrome | Adds the Chrome install to the package, so the managed browser is present before its policies apply. You download the Chrome Enterprise MSI and add it to the project folder. |
| Install Mobile Guardian extension | Installs the extension in Google Chrome during provisioning, so it is ready at first sign-in instead of waiting for MDM policy. |
| Install Google Credential Provider for Windows (GCPW) | Adds the GCPW install to the package. You still download the installer from Google and add it to the project folder. |
| Google domains allowed to sign in to Windows | Sets the Google Credential Provider for Windows (GCPW) allowed domains. Leave empty to use your Google Workspace domain. Separate multiple domains with commas. |
| Retry enrollment if it fails | Windows does not retry a failed enrollment, so a device provisioned without a network connection stays unmanaged. This schedules a retry that runs once the device can reach Mobile Guardian, and stops once enrolled. |
| Days to keep retrying enrollment | How long a device keeps trying before it gives up, from 1 to 90 days. Leave empty for 14 days. Allow for devices that are provisioned and then stored before anyone switches them on. |
- Select Save and Download Configuration Template
- Save the zip file to a USB drive along with the Chrome Enterprise MSI bundle and Google Credential Provider for Windows (GCPW) files you previously downloaded.
Step 2: Creating the Package
You would only need to create this package once per school. Then add the package to each device.
- Copy and unzip the Configuration Template in the Windows Configuration Designer folder found in your Documents folder.
- Add the GoogleChromeStandaloneEnterprise file found in the Installers folder and the gcpwstandaloneenterprise64 file to your Configuration Template folder.
Windows Configuration Designer
- Open Windows Configuration Designer
- Select Open under Recent Projects
- Select the runtime file from the above folder
- Edit settings
- If Windows Configuration Designer cannot find the InstallChrome and InstallGCPW paths, browse and select the correct paths.
- Under Runtime settings > ProvisioningCommands > PrimaryContext > Command > InstallChrome > CommandFile (GoogleChromeStandaloneEnterprise64.msi)
- StageGCPW > CommandFile (gcpwstandaloneenterprise64.msi)
Select the correct path for any command that is not automatically populated.
- Export the package file and follow the prompts to create.
- Copy the file directly to the main folder (root directory) of your USB flash drive.
Step 3: Device Enrollment Process:
- Add the Downloaded Package .ppkg (RunTime Provisioning Tool) to the device/s.
- Double-click the package on the device.
- A window will open asking if you Trust and want to add the package
- The Device will then prompt, advising of a reboot.
The device will now appear on your Mobile Guardian Dashboard.
Post Reboot
- Once the device has rebooted, you will see the option to Add Work Account
- Select this and enter the eligible student Email address and Password
- Follow the prompts
- Once completed, you will notice that Google Chrome will be installed
- Open the Google Chrome Browser and follow the prompts.
- The Student credentials will be automatically added to the Google Chrome Browser.
- After a few moments, the Extension will install on the device
You will only be required to create the .ppkg once per school and install it on a device.