If you manage a fleet of Chromebooks in a school setting, there are two questions that you need to quickly answer:

1. Which student signed in to that Chromebook?
2. Which device(s) did that student use?

To find this information, we need to use the Chrome log event search. This is a complex search using the audit and investigation tool. Let’s take a closer look together!

See who signed into a Chromebook

If you have a specific Chromebook and you need to know who used it last, you can pull up a list of recent users through the device page in the Google admin console. This is particularly useful if a device is lost, stolen, or damaged and you need to know who used it last.

Note: you must enable user tracking for your devices in order to view recent users. This setting is disabled by default.

1. Access the Admin Console: Begin by navigating to the Google Admin console (admin.google.com) and logging in with your administrator credentials.
2. Devices Section: Locate the “Devices” section within the console.
3. Chrome Devices: Click on “Chrome” and then “Devices” to view a comprehensive list of all Chromebooks enrolled in your domain.
4. Find the device: Search for the device in question by filtering by serial number or asset ID. Once you find the device, click on the serial number to open up the detailed device information.
5. View recent users: Scroll down to the “system activity and troubleshooting” section of the device information page. This is where you will see “recent users”. This section will display the last 100 users who have accessed this device.

Enable user tracking for your Chromebook fleet

If you don’t have any data listed under recent users, you probably need to enable this setting in the admin console.

Visit Devices > Chrome > Settings > Device Settings > User and Device Report and look for “report device user tracking.” You can also click here if you are signed into the admin console.

There are a few important things you should know about user tracking:

• This information is NOT reported in real time.
• 60 minutes is the maximum reporting frequency
• Only domain users will be reported. Non domain users will be masked.

View all devices accessed by a user

The steps outlined above only work if you know the serial number of the device in question. But what if you don’t know the device…just the user? Fortunately, there is a way that you can generate a list of all devices accessed by a given user using the audit and investigation tool.

This is a very helpful strategy if you have students who are using devices that are not assigned to them, or if there is suspicious activity performed by a user and you need to figure out which device they were using at the time.

Note: there are two versions of the audit and investigation tool: one for the free version of Google Workspace and one for the premium edition. You can perform this search with either edition, however the interface is slightly different.

Chrome Log Event Search

To begin, visit the audit and investigation tool: Reporting > Audit and Investigation > Chrome log event.

Chrome Log events include a wide range of data including login attempts, extension installation, browser updates, etc.

We are going to search the log events for a successful login by a specific user:

• Data source: Chrome Log events
• Condition/filter 1: Event > ChromeOS login success
• Condition/filter 2: Device User > [enter email of user in question]

The search results will return a list of successful logins by that user you specified. Scroll to the right to view the serial number of the device(s) that were accessed.

The audit and investigation tool retains data for 180 days and relies on the data collection settings that were outlined above.

Advanced Search Features for EDU Plus domains

If you have Google Workspace Education Plus, you have a few additional options.

1. Save your search – on the right side of the admin console you will see a save button. Saving this device search makes it easy to return, update, or perform a new search in just a few clicks.
2. Pivot your search – If you click on the serial number of a device listed in your search, you will see the option to pivot to a search by device. This is a quick way to jump between reviewing device access information (search 1) and user access information (search 2).

The audit and investigation tool can reveal lots of useful information about your domain. Ready to learn more? Join me for the Google Admin Bootcamp, my LIVE virtual training for Google Admins!