> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goguardian.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up Theft Recovery

> Create the organizational unit, install the Theft Recovery extension, and sync your devices with GoGuardian Admin to begin tracking missing Chromebooks.

To set up Theft Recovery, create a dedicated organizational unit (OU) in Google Admin Console, install the Theft Recovery extension, and sync your Chromebooks with GoGuardian Admin.

If you are migrating from the previous Theft Recovery extension, see [Migrate Chromebooks to New Theft Recovery Extension](/products/admin/migrate-chromebooks-theft-recovery).

## Create the Lost Devices Organizational Unit

1. Sign in to Google Admin Console as an administrator.
2. In the navigation menu, go to **Directory** > **Organizational units**.
3. Click **Create organizational unit**, name it **Lost Devices**, and save.

## Configure Managed Guest Session Settings

1. In the navigation menu, go to **Devices** > **Chrome** > **Settings** > **Managed guest session settings**.

2. Select the **Lost Devices** OU from the sidebar.

3. Apply the following settings:

   **Managed guest session**

   * Configuration: **Auto-launch managed guest session**
   * Session name: **Guest**
   * Auto-launch delay: **0**

   **Incognito mode**: **Disallow incognito mode**

   **Task manager**: **Block users from ending processes with the Chrome task manager**

   **URL blocking**: `javascript://*`

   **Screenshot**: **Allow users to take screenshots and video recordings**

   **Developer tools**: **Never allow use of built-in developer tools**

4. Save your changes.

## Apply Device Restrictions

1. Go to **Devices** > **Chrome** > **Settings** > **Device settings**.

2. Select the **Lost Devices** OU from the sidebar.

3. Configure the following settings:

   **Sign-in restriction**: **Do not allow any user to sign in**

   **Guest mode**: **Disable guest mode**

   **Forced re-enrollment**: **Force device to re-enroll after wiping**

   **Schedule reboot**: Enable it, set the frequency to **Daily**, and enter a reboot time, for example, midnight (00:00).

4. Save your changes.

<Note>
  After a device is placed in the Lost Devices OU, it must reboot at least once to launch the Theft Recovery extension. A daily Scheduled Reboot forces the device to restart once per day so the extension loads without waiting for a manual reboot.
</Note>

<img src="https://mintcdn.com/goguardian/fZFZb2zvl2cqCpv6/images/screenshots/set-up-theft-recovery/step-01.png?fit=max&auto=format&n=fZFZb2zvl2cqCpv6&q=85&s=7b258fa2f4959e99136040debca30d31" alt="devices.png" width="1999" height="944" data-path="images/screenshots/set-up-theft-recovery/step-01.png" />

<img src="https://mintcdn.com/goguardian/fZFZb2zvl2cqCpv6/images/screenshots/set-up-theft-recovery/step-02.png?fit=max&auto=format&n=fZFZb2zvl2cqCpv6&q=85&s=82d6dc36113dcbf809c407a33120af0c" alt="chromemgmt.png" width="1999" height="1047" data-path="images/screenshots/set-up-theft-recovery/step-02.png" />

<img src="https://mintcdn.com/goguardian/fZFZb2zvl2cqCpv6/images/screenshots/set-up-theft-recovery/step-03.png?fit=max&auto=format&n=fZFZb2zvl2cqCpv6&q=85&s=2b4321deb473eaba69b160e1fff8fd1d" alt="devicesettings.png" width="1999" height="1104" data-path="images/screenshots/set-up-theft-recovery/step-03.png" />

<img src="https://mintcdn.com/goguardian/fZFZb2zvl2cqCpv6/images/screenshots/set-up-theft-recovery/step-04.png?fit=max&auto=format&n=fZFZb2zvl2cqCpv6&q=85&s=3488213b72888ca316a720a4d5473683" alt="deviceOU.png" width="1999" height="1047" data-path="images/screenshots/set-up-theft-recovery/step-04.png" />

<img src="https://mintcdn.com/goguardian/fZFZb2zvl2cqCpv6/images/screenshots/set-up-theft-recovery/step-05.jpg?fit=max&auto=format&n=fZFZb2zvl2cqCpv6&q=85&s=6ac25088c4b56a3bf1d53b33acb11372" alt="reenroll5.jpg" width="458" height="100" data-path="images/screenshots/set-up-theft-recovery/step-05.jpg" />

<img src="https://mintcdn.com/goguardian/fZFZb2zvl2cqCpv6/images/screenshots/set-up-theft-recovery/step-06.png?fit=max&auto=format&n=fZFZb2zvl2cqCpv6&q=85&s=7d7af5f8ed17160e4c2dd0d9c039e2e3" alt="forcedreenroll.png" width="1999" height="1047" data-path="images/screenshots/set-up-theft-recovery/step-06.png" />

<img src="https://mintcdn.com/goguardian/fZFZb2zvl2cqCpv6/images/screenshots/set-up-theft-recovery/step-07.png?fit=max&auto=format&n=fZFZb2zvl2cqCpv6&q=85&s=3598a9ebc03e1422876cdb418f23e5e2" alt="saveforced.png" width="1999" height="1047" data-path="images/screenshots/set-up-theft-recovery/step-07.png" />

## Install the Theft Recovery Extension

<Warning>
  Only apply these extension settings to the **Lost Devices** OU. Installing the Theft Recovery extension at the domain level or in any OU that contains active devices will place all devices in that OU into Theft Recovery mode. Devices in Theft Recovery mode have no web filtering applied and do not require a user to sign in.
</Warning>

1. Go to **Devices** > **Chrome** > **Apps & extensions** > **Managed guest sessions**.

2. Select the **Lost Devices** OU.

3. Click the **Add** icon and choose **Add Chrome app or extension by ID**.

4. Enter the following extension ID:

   `ejblgkabfnkbdjmdkpfgojkohmgnpblh`

5. Select **From a custom URL**.

6. Enter the following URL:

   `https://theft-recovery-ext.goguardian.com/production.xml`

7. Select **Force install**.

8. Save your changes.

9. Verify the result: On a target device in the Lost Devices OU, confirm that guest session mode is enabled on the login screen. After signing in as a guest, confirm that the Theft Recovery extension is installed in Chrome.

## Authorize GoGuardian to Access Google Admin Console

1. Sign in to GoGuardian Admin and go to **Theft Recovery**.
2. Click the three-dot menu in the top right corner and select **Settings** > **Authorize with Google**.
3. Log in with a Google Admin Super User account when prompted.
4. Click **Allow Access** to complete the authorization.

Authorizing the sync grants GoGuardian the following Google Admin account permissions:

* Provision and delete users on your domain, including viewing and modifying user details and metadata
* View metadata, such as name and description, of organizational units
* View all Chrome OS device metadata and view and update a specific Chrome OS device's metadata

## Sync Devices from Google Admin Console

1. In GoGuardian Admin, go to **Theft Recovery**.
2. Click the three-dot menu and select **Sync Devices**.
3. Click **Sync Google Admin Console**.
4. Verify the result: Your managed Chromebooks appear in the device list under the **Active** tab in Theft Recovery.

## Resources

* [Understand Theft Recovery](/products/admin/theft-recovery)
* [Migrate Chromebooks to New Theft Recovery Extension](/products/admin/migrate-chromebooks-theft-recovery)
* [Track a Missing Device](/products/admin/track-a-missing-device)