How to Configure Managed Guest Sessions and Kiosk Mode on Chromebooks

Public libraries, university computer labs, healthcare intake check-ins, and retail environments require shared workstation computing that guarantees zero residual user data between sessions. Standard personal logins or unmanaged guest browsing risk data leakage if a visitor forgets to log out of their email or banking session. Through the Google Admin Console, Managed Guest Sessions (MGS) and Single-App Kiosk Mode transform ChromeOS devices (Chromebooks, Chromeboxes, Chromebases) into secure, zero-footprint public workstations where all browsing caches, cookies, downloads, and session histories are cryptographically destroyed upon exit.

Managed Guest Sessions vs Single-App Kiosk Mode

ChromeOS supports two distinct shared-device operating models:

• Managed Guest Sessions (MGS): Multiple users can access a full Chrome browser environment without logging in with a Google Account. IT administrators can pre-install web shortcuts, enforce content filtering, configure printer connections, and set inactivity timers. The instant the user clicks “Exit session”, ChromeOS purges all cryptographic encryption keys, wiping the device back to its baseline image.
• Single-App Kiosk Mode: Locks the device into a single fullscreen web application, digital signage player, or standardized testing client. Users cannot access browser toolbars, desktop settings, or external URLs.

Configuring Managed Guest Sessions in Google Admin Console

Deploy a standardized public browsing session across an Organizational Unit (OU):

1. Sign in to the Google Admin Console (admin.google.com) with Chrome Enterprise administrator credentials.
2. Navigate to Devices > Chrome > Settings > Managed guest session settings.
3. Select your target Chromebook Organizational Unit in the left tree.
4. Under Managed guest session, set the policy to Enable managed guest session.
5. Configure session branding: upload an organization logo and define custom session descriptions displayed on the lock screen.
6. Under Startup, configure default homepage tabs (e.g., your organization’s public catalog or portal URL).

Enforcing Security Policies and Auto-Logout Timers

Prevent unattended workstations from remaining active in public spaces:

1. In Managed guest session settings, scroll to Session timeout.
2. Set Auto-logout on idle to 5 minutes (or 10 minutes). When no mouse or keyboard input is detected, ChromeOS displays a 30-second warning countdown before automatically logging out and destroying all session data.
3. Navigate to Content verification:
   • Set SafeSearch to Always enforce SafeSearch.
   • Under URL blocking, blacklist unapproved domain categories to maintain institutional compliance.
4. Under External storage, select Disallow external storage devices to prevent users from plugging in untrusted USB drives.

Configuring Single-App Kiosk Mode for Self-Service Check-In

To lock a Chromebox into an interactive self-service portal:

1. Navigate to Devices > Chrome > Apps & extensions > Kiosks.
2. Select the target OU and click the yellow plus (+) icon.
3. Select Add Web App, input your check-in portal URL (e.g., https://checkin.clinic.org), and click Save.
4. In the Auto-launch app dropdown at the top of the page, select your newly added web application.
5. Click Save.

When enrolled ChromeOS devices reboot, they launch directly into the fullscreen kiosk application without presenting login prompts, delivering a secure, tamper-proof customer experience.