Skip to main content
To set up Theft Recovery, create a dedicated organizational unit (OU) in Google Admin Console, install the Theft Recovery extension, and sync your Chromebooks with GoGuardian Admin. If you are migrating from the previous Theft Recovery extension, see Migrate Chromebooks to New Theft Recovery Extension.

​
Create the Lost Devices Organizational Unit

  1. Sign in to Google Admin Console as an administrator.
  2. In the navigation menu, go to Directory > Organizational units.
  3. Click Create organizational unit, name it Lost Devices, and save.

​
Configure Managed Guest Session Settings

  1. In the navigation menu, go to Devices > Chrome > Settings > Managed guest session settings.
  2. Select the Lost Devices OU from the sidebar.
  3. Apply the following settings: Managed guest session
    • Configuration: Auto-launch managed guest session
    • Session name: Guest
    • Auto-launch delay: 0
    Incognito mode: Disallow incognito mode Task manager: Block users from ending processes with the Chrome task manager URL blocking: javascript://* Screenshot: Allow users to take screenshots and video recordings Developer tools: Never allow use of built-in developer tools
  4. Save your changes.

​
Apply Device Restrictions

  1. Go to Devices > Chrome > Settings > Device settings.
  2. Select the Lost Devices OU from the sidebar.
  3. Configure the following settings: Sign-in restriction: Do not allow any user to sign in Guest mode: Disable guest mode Forced re-enrollment: Force device to re-enroll after wiping Schedule reboot: Enable it, set the frequency to Daily, and enter a reboot time, for example, midnight (00:00).
  4. Save your changes.
After a device is placed in the Lost Devices OU, it must reboot at least once to launch the Theft Recovery extension. A daily Scheduled Reboot forces the device to restart once per day so the extension loads without waiting for a manual reboot.
devices.png chromemgmt.png devicesettings.png deviceOU.png reenroll5.jpg forcedreenroll.png saveforced.png

​
Install the Theft Recovery Extension

Only apply these extension settings to the Lost Devices OU. Installing the Theft Recovery extension at the domain level or in any OU that contains active devices will place all devices in that OU into Theft Recovery mode. Devices in Theft Recovery mode have no web filtering applied and do not require a user to sign in.
  1. Go to Devices > Chrome > Apps & extensions > Managed guest sessions.
  2. Select the Lost Devices OU.
  3. Click the Add icon and choose Add Chrome app or extension by ID.
  4. Enter the following extension ID: ejblgkabfnkbdjmdkpfgojkohmgnpblh
  5. Select From a custom URL.
  6. Enter the following URL: https://theft-recovery-ext.goguardian.com/production.xml
  7. Select Force install.
  8. Save your changes.
  9. Verify the result: On a target device in the Lost Devices OU, confirm that guest session mode is enabled on the login screen. After signing in as a guest, confirm that the Theft Recovery extension is installed in Chrome.

​
Authorize GoGuardian to Access Google Admin Console

  1. Sign in to GoGuardian Admin and go to Theft Recovery.
  2. Click the three-dot menu in the top right corner and select Settings > Authorize with Google.
  3. Log in with a Google Admin Super User account when prompted.
  4. Click Allow Access to complete the authorization.
Authorizing the sync grants GoGuardian the following Google Admin account permissions:
  • Provision and delete users on your domain, including viewing and modifying user details and metadata
  • View metadata, such as name and description, of organizational units
  • View all Chrome OS device metadata and view and update a specific Chrome OS device’s metadata

​
Sync Devices from Google Admin Console

  1. In GoGuardian Admin, go to Theft Recovery.
  2. Click the three-dot menu and select Sync Devices.
  3. Click Sync Google Admin Console.
  4. Verify the result: Your managed Chromebooks appear in the device list under the Active tab in Theft Recovery.

​
Resources

Last modified on July 10, 2026