Installing HomeProtect on Chromebooks
Prerequisites
Installation
The extension is deployed using the Google Admin Console.
Sign into the Google Admin Console and go to Devices > Chrome > Settings > User & Browser settings. Search for Manifest V2 extension availability or use this link.
Set Configuration to Enable force-installed Manifest V2 extensions
Naviage to Devices > Chrome management > Apps & Extensions.
Navigate to the Organisational Unit (OU) where the pupil accounts exist. Apps are deployed to users rather than devices, so make sure you are targeting the pupil OU.
Hover over the + sign in the bottom-right-hand corner and click the icon for Add Chrome app or extension by ID (hover over icons to see the title).
Paste the following into the Extension ID field: hbfjkkjpagboiaaaagmbcfhomnmiloco
Change ‘From the Chrome Web Store’ to ‘From a custom URL’
Paste the following into the URL field: https://safehomeschool.net/extensionautoupdate.xml
Set the Installation policy to Force install.
Click Save.
Follow the guidance in the ‘Prevent Bypass’ section below to stop pupils bypassing the filter.
Follow the instructions at the bottom of this document on enforcing a YouTube mode.
Consider the final sections about the Vimeo video player and how to whitelist or blacklist sites you are unhappy with students accessing or not being able to access.
The extension will now be pushed to all user devices and browsers.
Google Admin Console Support Guide: Automatically install apps and extensions - Google Chrome Enterprise Help
Prevent Bypass
As well as force-installing the extension, there are a number of security settings that need to be applied through the Google Admin console to prevent students from easily bypassing the filtering.
There are 2 types of policy: user policies and device policies. User policies must be applied to the OUs which contains the students you want to protect, and device policies must be applied to the OUs which contains the devices they will be using. You can apply both sets of policy to the top-level OU to cover all devices and users in your domain.
To set these policies, navigate to the following locations in the Google Admin Console:
Policy Type
Policy Name
Recommended Setting
Details
User Policy
Security > Incognito mode
Disallow incognito mode
Extensions do not run in incognito mode so this must be disabled.
User Policy
User experience > Developer Tools
Never allow use of built-in developer tools
OR Allow use of built-in developer tools except for force-installed extensions
Developer tools can be used to alter how extensions work so these should either be disabled completely or blocked for managed extensions.
Device Policy
Sign-in settings > Sign-in restriction
Restrict sign-in to a list of users
(Enter *@yourdomain.com in the list)
If a user signs in with a non-school Google account, the extension will not be applied.
Device Policy
Sign-in settings > Guest mode
Disable guest mode
Guest mode works like incognito mode, so would not run the extension.
Device Policy
Enrolment and access > Forced re-enrolment
Force device to automatically re-enrol into this domain after wiping
If the device is reset, this setting will connect it back to the school domain and it will automatically pick up the extension and settings again.
User Experience
When the user first logs into a device, they will see the following privacy notice which they will need to agree to. This will show regardless of whether the device is in school or at home.
Generally, on Chromebooks, the user should not be prompted to sign in to HomeProtect as it will use the G Suite login name. If they are prompted with the Sign in with Microsoft/Google screen and cannot progress, please follow the troubleshooting steps below.
Websites and Content Considerations
YouTube Mode
YouTube is allowed by this filtering service. However, it is important that you apply one of the restricted modes to your pupils by using the instructions below. You can choose between moderate restricted (most secondaries prefer this and it is more relaxed) and strict restricted (most primaries use this and it is the most strict, but may block videos you want pupils to see – if this is the case you can whitelist them – see YouTube.lgfl.net for how to do this).
Open the user policy: Devices > Chrome management> User & browser settings.
Navigate to the OU where the pupil accounts exist.
Find the policy Content > SafeSearch and Restricted Mode.
Set Restricted Mode for YouTube to enforce either Moderate Restricted or Strict Restricted mode. Use the links below to decide which option to use for your pupils.
To set up approvals to allow teachers to whitelist videos, read the information in the links below.
For more details, see www.youtube.lgfl.net or https://support.google.com/a/answer/6212415?hl=en
Search Engines and Video Sites
Search engines are limited to those that we can enforce safe search on. This includes:
Vimeo
Vimeo.com is blocked as a lot of videos are very inappropriate for pupils and there is no way to enforce safe search. The embedded version of Vimeo (player.vimeo.com) is unblocked as there are many educational resources using Vimeo to host videos. This allows embedded videos to play on sites that are unblocked. This is a compromise – it allows sites to function and stops students searching on Vimeo; at the same time though, an enterprising student could find a video code on another device and combine that with the allowed player url to access an inappropriate video. You can use the management console to either block player.vimeo.com to prevent all access to Vimeo content, allow vimeo.com (strongly not recommended) to allow the whole of Vimeo to be accessible to your students including the unsuitable material or add individual video URLs to the allow list to allow direct browsing to specific, approved videos.
Troubleshooting
Issues Logging In
If HomeProtect does not recognise the domain name that the user has signed in with, they will be taken back to the sign in page. Under the ‘Technical Details’ button it will show ‘no login name or password’.
The first thing to check is the domain name of the user account matches the domain name supplied during sign-up. If the registered domain is incorrect, please contact support who will correct it. Please note, it is the domain name of the user, not the primary domain for the Google or Microsoft tenancy.
If you have confirmed the domain name is correct the other potential cause of login issues is where the Microsoft or Google domain is ‘federated’ with a 3rd party identity provider or internal ADFS server and the service is being blocked by HomeProtect. This will generally mean that the user does not get the opportunity to even enter their password and are taken back to the sign in page instead.
Most common federated identity providers have been whitelisted in HomeProtect, but if yours does not work, please contact support who will work out and whitelist the required addresses.
Websites not loading despite being added to the Allow List
Many websites have multiple dependent addresses that all need to be allowed for the website to properly work. The easiest way to work out which addresses need to be added to the Allow list is to use the developer tools in Chrome to see which domains a site calls. Open the Network tab and reload the page. Make sure you have the Domain column visible (right click the column headings to add it). You will see all the domains the site requires:
Google popup stating Access blocked: Your institution's admin needs to review LGfL HomeProtect
Occassionally if you are restricting 3rd party applications, you may get this error:
To review and allow LGfL HomeProtect to allow users to make use of this, to do that you need to:
- Load your Google Admin console.
Click Security > Access and Data Control.
Click API controls and then on the top right choose manage third-party app access.
Click the Configure new app button and enter the ID for HomeProtect (432803496093-1cuunhq4i4f0n5tpdhhm7pvhg01bn4g6.apps.googleusercontent.com)
Save that and this will allow it for you.
Contacting Support
If you face any issues or just need some help or guidance, please email homeprotect@lgfl.net. To help us to resolve your issue as quickly as possible, please include the following information:
School and authority/MAT details.
Name of person who completed the sign up form if it is not yourself.
Platform (e.g. Chrome, Windows, iOS).
A screenshot of the block page. Please click Technical Details and ensure the text is included.
Full Google/Microsoft username of the pupil/test account (including domain name).
Steps to reproduce the problem.