This article is written for GSuite Super Admins.

If you don't know what Safe Doc is, check out this What is Safe Doc article. In a nutshell, Safe Doc is a chrome extension that helps school administrators manage inappropriate features in G Suite that Admin Console doesn't provide. This chrome extension applies to Chromebooks and Chrome browsers.

Now let's start setup.

0. Prerequisites

1. Create an Organization Unit (OU)

An Organization Unit (OU) is recommended because it allows you to assign specific policies to users in the OU without impacting other domain users. In our case, the chrome extension will be installed only for the students OU. If your school has more complex students structures, you can create sub-OUs to further segments them.

If you didn't know create an OU, please follow Google's doc Add an organizational unit extension. In this article, we only focus on the setup of Safe Doc extension.

Create an Organization Unit (OU) for students in Admin Console
Create an Organization Unit (OU) for students in Admin Console (Directory > Organizational units)

2. Add Students to the OU

Now you add student users, who use this extension, to the students OU. The following screenshot is in Directory > Users. See more instructions from Google's doc Move users to an organizational unit.

Target students are put into the students OU
Target students are put into the students OU

3. Customize User & Browser Policy to the OU

Some security policies are required so that the Safe Doc chrome extension cannot be easily shutdown or tampered by students. We know they are curious.

Of course, the following policies only matter to the operation of Safe Doc extension. You definitely will apply other policies like Youtube content sensitivity, to further control the content for students.

Select User & browser settings in Chrome management
Select User & browser settings in Chrome management
  • Disable Developer Tools for force-installed extensions. Select
    • either Never allow use of built-in developer tools (Recommended)
    • or Allow use of built-in developers except for force-installed extensions
Disable developer tools in Chrome settings
Disable developer tools in Chrome settings
  • Disable Incognito mode. Explain: Incognito mode disables all extensions, including force-installed applications, including Safe Doc.
Disable incognito mode in Chrome settings
Disable incognito mode in Chrome settings
  • Whitelist our license server in your Chrome policy settings. In the URL blocking section > URL blacklist exceptions, add a new line denali.xfanatical.com. These 2 Google articles documented the usage of site blocking, Allow or block access to websites and URL Blacklist filter format.
  • Whitelist our license server (https://denali.xfanatical.com) in your firewall. This is beyond the scope of this article. Please contact your network administrator if you are not in charge of the network.
  • Verify if the license server is reachable now by clicking https://denali.xfanatical.com. If it tells you Not Found, that's a successful test.
Whitelist our license server in your chrome policy
Whitelist our license server in your chrome policy

4. Install Safe Doc on Students' Chromebooks

Installation of a chrome extension can be done easily on Admin Console, without physical access to users' devices. General steps has been described in Google Help Article Automatically install apps and extensions. Specifically for Safe Doc, follow this instruction.

  1. Go to Devices > Chrome management > Apps & extensions.
  2. Under the left panel, select your students' OU, so the extension will be installed only under this OU.
  3. Hover on the + button and click the Chrome Web Store button to find an extension from Chrome Web Store.
    Add an extension in Chrome Apps & extensions
  4. Now type Safe Doc in the search bar and click Select to install.
    Find and install Safe Doc from the Chrome Web Store
  5. With Safe Doc being added into the list, select installation policy as Force install.
  6. Download the attachment text file in your trial license confirmation email.
  7. In the Policy for extensions, upload the attachment file. It's a JSON formatted content, including the license key for your school as well as configurations to disable features conditionally.
  8. Click Save.
    force install Safe Doc in Admin Console

Here is an example of extension policy,

{
   "SafeDocLicenseKey": {
     "Value": "04fdc2ca-f9b3-11e9-969d-878ce7c660bf"
   },
   "EnableExplore": {
     "Value": false
   },
   "EnableDictionary": {
     "Value": false
   },
   "EnableVideoSearch": {
     "Value": false
   },
   "EnableImageSearch": {
     "Value": false
   },
   "BlockAddVideo": {
     "Value": false
   },
   "BlockEmojis": {
     "Value": ["🖕", "🗡", "🔫", "🔪"]
   }
}

That's all for setup in Admin Console. Let's validate if this works.

5. Validate your Setup of Safe Doc

Validate if Safe Doc is force-installed on students' Chromebooks. It's easier to test on a mock user and a spare Chromebook than request access to students' Chromebooks they are currently using. We assume you have the mock user added in the OU and logged in a Chromebook now.

  • Open Chrome browser in a Chromebook.
  • In a few seconds, the Safe Doc icon will be displayed in the toolbar, in GREEN. It means the extension functions properly.
  • If the icon is colored in GREY, it's not functioning properly for the following reasons.
    • The Safe Doc chrome extension is installed directly from Chrome Web Store.
    • The Configuration File in Step 4 isn't given.
    • The license key in configuration file is invalid (expired, misused etc)
    • The student's email domain does not match with the student domain of license key.
    • Software bugs. If none of above applies to you, it's likely a software issue from our end. You can send an email to support@xfanatical.com.
Safe Doc Status in colors
Safe Doc Status in colors

Now you have Safe Doc working properly (displayed in GREEN). It's time to do some real field testing.

  • Open any Google Doc, Sheet, Slides, Forms or Drawing document. The image search and youtube video search features are no longer accessible to students.
  • We take Google Doc and Slide as the examples.
  • The Insert > Image > Search the web is not visible any more. Safe Doc also blocks similar menu entries in different places. As you know, Search the web can trigger image search. But now it's impossible
Block Search the web that activates image search with Safe Doc
Block Search the web that activates image search with Safe Doc
  • The Explore widget on the bottom right of Google Docs and Slides will be removed. It also remove other places like in the context menu that trigger the Explore feature. The Explore feature allows students to search wobbly filtered web and images. This extension will stop that.
Block Explore Widget in Google Docs
Block Explore Widget in Google Docs

Now look at the video search in Google Slides

  • Click the menu Insert > Video...
  • A dialog will popup. It used to show Youtube search in a Search tab. However, Safe Doc can remove it for you. Students cannot search youtube videos but type in managed youtube URLs, which is safer.

Now verify if ALL of your students in the OU have Safe Doc enabled in GREEN.

Please find features in the Safe Doc Support Page.

Upgrade License

When you purchased the annual license, follow these steps to activate the new license.

  1. Login into your Admin Console.
  2. Go to the Devices > Chrome management > Apps & extensions page
  3. Under your students' OU, select Safe Doc.
  4. In the Policy for extensions section of right panel, replace the existing trial license with the new annual license.
    Upgrade safe doc license in policy for extensions
  5. Click Save.
  6. The new license key will propagate to students' Chromebooks in a few minutes after when they are online.

Uninstall Safe Doc

Uninstalling Safe Doc from your students' Chromebooks is quite simple.

  1. Just like the steps above, login into your Admin Console.
  2. Go to the Devices > Chrome management > Apps & extensions page
  3. Under your students' OU, select Safe Doc.
  4. On the right panel, click the trash bin button (illustrated in the screenshot below).
  5. Click Save.
  6. The extension will be automatically unloaded remotely from your students' Chromebooks.
Uninstall Safe Doc from students' OU
Uninstall Safe Doc from students' OU

Wrap up

Please take patience to configure enterprise-level applications. It's often more complex and error-prone than individual account setup. So if there are confusions in this article, please don't hesitate to comment below or email us at support@xfanatical.com.