How to filter every school Chromebook with Google Admin

One policy in the Google Admin console filters every managed Chromebook on any Wi‑Fi: at school, at home and on a phone hotspot.

Updated November 11, 2026·2 min read

Short answer

In the Google Admin console, go to Devices, Chrome, Settings, Users and browsers, pick the student organizational unit, and under Network set DNS-over-HTTPS to "Enable DNS-over-HTTPS without insecure fallback". Paste your Sheepdog Filter secure DNS address from the dashboard into DNS-over-HTTPS templates, and save. Chromebooks pick it up at their next policy sync.

Before you start

You need a Google Workspace for Education admin account and Chromebooks that are enrolled in your domain. In your Sheepdog Filter dashboard, the School Chromebooks row shows your secure DNS address with a Copy button. It looks like `https://dns.sheepdogfilter.com/abc123/school-chromebooks`.

Step 1: Open the Chrome settings

  1. Sign in to admin.google.com.
  2. Go to Devices, then Chrome, then Settings, then Users & browsers.
  3. On the left, pick the organizational unit your students are in. Staff OUs can stay as they are, or use the Staff address.

Step 2: Set secure DNS

  1. Search the settings for DNS-over-HTTPS.
  2. Set DNS-over-HTTPS to Enable DNS-over-HTTPS without insecure fallback. (Under the hood this is Chrome's DnsOverHttpsMode policy, set to "secure".)
  3. In DNS-over-HTTPS templates, paste your School Chromebooks address.
  4. Click Save.

Chromebooks pick it up at their next policy sync, usually within an hour. A restart makes it immediate. Students can't change it, because it's managed.

Step 3: Lock the doors students try

In the same settings, for the student OU:

  • Guest mode: set Allow guest mode to off (Device settings), so nobody can browse outside the policy.
  • Incognito mode: disallow it. The DNS policy still applies in incognito, but this removes a common habit.
  • Developer tools: block them.
  • Chrome Web Store: allow only the extensions you've approved, so VPN and proxy extensions can't be added.
  • Android apps: allow only approved apps, so VPN apps can't be installed.

Step 4: Check it worked

On a student Chromebook, open chrome://policy and confirm DnsOverHttpsMode is "secure" with your address. Then try a game site: it won't load, on school Wi‑Fi or at home. Your dashboard's School Chromebooks row turns green once they're using the filter.

Sheepdog Filter

The filter students can't get around.

Games, unblocked-games mirrors, proxies, VPNs and social media blocked on your network and every managed Chromebook. Free to start, live in an afternoon.

Set up our school, free

Questions school IT asks

Does this need the school Wi‑Fi to be filtered too?

No, the Chromebook policy works on any network. We still recommend filtering the school network so phones and other devices are covered.

Will students see a different block page?

Blocked sites simply don't load. Students see Chrome's normal "site can't be reached" message, with no certificate warnings.

Can I tell which Chromebook visited what?

All managed Chromebooks share one address, so reports show the whole fleet. For a separate report per class or grade, add a device address per organizational unit in the dashboard and paste each one into its own OU.

Keep reading