The School Gave My Kid a Chromebook and I Can't Put Parental Controls On It

It is the last week of August, the Chromebook came home in a backpack, and you have spent an evening trying to put some limits on it. You installed Family Link. You tried to add your child's school account to your family group. You got an error, or the controls appeared and then did nothing, or the option was greyed out entirely. Then you searched, and every result told you to do the thing you just tried.

You are not doing it wrong. On a Chromebook that belongs to a school district, the tools those articles are selling cannot work — and that is not a bug or a version problem, it is how the device is built. Google states it plainly in its own help pages: if a child is on both a school Chromebook and a school Google Account, parents cannot add controls. The reason the first page of search results does not lead with that is that most of it is written by companies selling parental-control apps, and "the product cannot be installed on your device" is a hard sentence for them to write.

So here is the honest version, in the order that actually matters: which of two situations you are in, how to tell in thirty seconds, what you genuinely can control in each, and the one lever that works on any device in the house regardless — your own network.

Everything depends on one question: whose Chromebook is it?

Two very different setups get described with the same words at the kitchen table, and almost every piece of bad advice online comes from mixing them up.

The first is a school-owned, school-enrolled Chromebook. The district bought it, enrolled it in their management console before it ever reached you, and it is running their policies whether it is sitting in a classroom or on your sofa. The second is your own Chromebook — one you bought — that your child signs into with the school's Google account, or with both that and a personal one.

In the first case your options on the device itself are close to zero, and the useful work happens on your network. In the second case you have real control, and there is a specific setup step that decides whether you keep it or lose it. Sort out which one you have before you change a single setting.

The thirty-second check that tells you which one you have

Do not go by whether it has a school sticker on it. Open Chrome on the device, type chrome://management into the address bar and press Enter. That page tells you, from the device itself, whether it is managed and by whom. The shorter version: open the three-dot menu at the top right of Chrome and look at the very bottom of it — if the device is under an organisation's control you will see a "Managed by your organization" line there, and if you do not see it, it is not managed.

You can also often see it on the sign-in screen itself, where a managed Chromebook shows the organisation it is enrolled to underneath the account list. Worth doing this even if you are sure: we regularly meet families who assumed a hand-me-down or a second-hand marketplace Chromebook was theirs and found a district still holding the enrolment.

If it is the school's device: what you cannot do, and why

On an enrolled Chromebook, the district's administrators set policy from a console you have no access to. Google's guidance to families is that when a child uses a school Chromebook, the school may restrict services such as websites and apps, and that if something they need is blocked — even their own home Wi-Fi, Bluetooth, or a screen reader — the answer is to contact the school, because those permissions live with the administrator.

That cuts both ways. It means you cannot add restrictions any more than you can remove them. You cannot supervise the school account with Family Link. You often cannot add your own account at all: administrators can set a sign-in restriction that only allows accounts from the school's own domain, which is exactly what a district does to stop a student signing in with a personal account to get around the filter. And you cannot reset your way out of it — on a managed Chromebook a Powerwash is frequently blocked, and when it does run the device usually re-enrols itself right back under the district afterwards. Our guide to a Chromebook that will not start goes through that in more detail; the short version is that wiping a school device is a good way to lock a student out of their own account before homework is due.

This is worth accepting early rather than fighting for a week. The device is on loan from an organisation with a legal duty of care over what happens on it, and it is configured accordingly.

The part nobody leads with: the school's filter usually comes home too

The framing that makes parents anxious is "I have no controls on this thing." That is not the same as "this thing has no controls." Google's own guidance to school administrators preparing Chromebooks for use at home is to use blocklists so that students cannot reach the same content on their Chromebooks at home as they cannot at school. The management is designed to travel with the device, not to stop at the school gate.

Whether your district actually configured it that way is a real question, and it is a question with an easy answer: ask them. Most districts have a technology coordinator or a help desk, and most publish an acceptable-use policy that describes what is filtered. That one email will tell you more about what your child can reach on that specific device than any amount of poking at settings, and it costs you five minutes. It is also the right route if something legitimate is blocked, because the administrator is the only person who can unblock it.

If it is your Chromebook: the setup mistake that quietly costs you every control

This is the most useful thing in this article, and it is almost entirely absent from the guides that rank for it.

On a Chromebook you own, with a child supervised through Family Link, there are two completely different ways to put the school account on the machine — and they look nearly identical while you are doing it. If you add the school account as a new user from the Chromebook's sign-in screen, it becomes its own separate profile, and Google is explicit that Family Link parental controls will not apply to that user account. Your controls are still there. Your child simply is not inside them for the entire school day, and you have no way to tell from the outside.

The other way is to add the school account as a secondary account inside the supervised profile — your child signs in as themselves, under supervision, and the school account is added within that session. Done that way, the supervision holds: Google's documentation describes the child being able to switch between accounts to check email and to use school tools like Classroom under parent supervision, on ChromeOS 89 and up, which is every Chromebook still in service.

One honest caveat so it is not a surprise. Even in the correct setup, while your child is actually signed in and working under the school account, the school's account settings apply — Google Workspace for Education administrators decide which Google services students can reach, and that can include things the supervised account previously blocked, or things it previously allowed. Set it up the right way, and then know that the school-account half of the day is governed by the school.

What Family Link genuinely controls on a Chromebook you own

Since it is worth knowing what you are actually buying into: on a personal Chromebook with a supervised child account, Family Link lets you manage which websites the child can visit in Chrome and limit their ability to grant permissions to sites, choose which apps they can use and what permissions those apps get, and set Chrome to block most sexually explicit and violent sites. That is a real toolset. It is just a toolset for a device you own.

If you hit a "can't supervise this account" error while setting it up, Google has a named page for exactly that, and the fixes are unglamorous: the Chromebook needs to be updated, since Family Link support for children on Chromebooks requires a minimum ChromeOS version; quit the Family Link app, wait a few minutes and try adding supervision again; have your child open their Google Account's "Recently used devices" page and remove the Chromebook that is failing, then retry; and if your child was sent a consent email for you to approve, follow that first. Work through those before you conclude the account is broken.

The lever you always have: your own network

Here is the thing that is true no matter whose Chromebook it is. The device may belong to the district, but the Wi-Fi belongs to you, and every filtering decision made at your router applies to everything that connects to it — the school Chromebook included, with no app to install and nothing to enrol.

There are two useful controls at that layer. The first is time: most current routers and mesh systems can pause internet access for one named device, or put it on a schedule, so the school Chromebook goes off the air at ten on a school night without you negotiating with anyone. It works on the device's network address, so it does not care that the device is managed. It is worth taking ten minutes to find where your particular router hides this and to give each device a recognisable name while you are in there, because "android-4f2c" is useless at eleven at night.

The second is content, and it is set once for the whole house. Your router asks a DNS server to turn every site name into an address, and if you point it at a filtering DNS service instead of your provider's default, the filtering applies to every device on the network. Cloudflare runs a free one: set your router's DNS servers to 1.1.1.2 and 1.0.0.2 to block domains associated with malware and phishing, or 1.1.1.3 and 1.0.0.3 to block those plus adult content. When a site is on the list, the lookup simply returns nothing usable and the page does not load. Change it in one place — the router — and it covers the Chromebook, the tablet, the games console and the TV together.

Why this works better on a school Chromebook than on a personal laptop

There is a well-known hole in router-level DNS filtering, and it is worth understanding because on a managed Chromebook it is closed for you.

Modern browsers can do their own encrypted DNS lookups — Chrome calls it secure DNS — which means the browser can bypass the DNS server your router handed out, and the filter never sees the request. It is the standard way a determined teenager walks around a home filter on an ordinary laptop.

On a managed device it is not available. Google's own documentation says that if your device is managed or parental controls are turned on, you cannot use Chrome's secure DNS feature. The same enrolment that stops you adding controls also stops the most common way of evading the one control you do have. It is a small piece of good news in a situation that mostly does not have any.

Four things network filtering will not do — know them before you rely on it

It does not follow the device off your Wi-Fi. A phone hotspot, a friend's house, the library, the school's own network — none of them are yours, and none of them are filtered by your router. If the Chromebook can reach a hotspot, your rules end there.

It cannot see inside a site it allows. DNS filtering works on domain names, so it is all-or-nothing: you can block a video site entirely, but you cannot block one channel on a site you have allowed, and you cannot filter search results. If what you want is granular control over one platform, this is the wrong tool and you should be asking the school what their filter already does about it.

It is not monitoring. It blocks; it does not report to you. If you want to know what your child is doing rather than to fence it, that is a conversation, not a setting.

And it is not a substitute for the district's filter, which is doing the heavy lifting on the school device. Think of your router as a second, blunter layer you control, added underneath one you do not.

What not to buy, and what not to try

Do not buy a parental-control app or extension to install on an enrolled school Chromebook. On a managed device, administrators control which extensions and apps can be installed, so at best it will not install and at worst you have paid a subscription for something that silently does nothing. Check whose device it is before you enter a card number, not after.

Do not go looking for a way to remove the management. The tools and videos that promise to de-enrol a Chromebook are aimed at students trying to get around a school filter, not at parents, and using one on a device the district owns can breach the acceptable-use agreement you signed, lock the student out of their school account, and in the worst case leave you owing for a device you have made unusable. It is not your Chromebook.

And do not spend money on a second-hand Chromebook to solve this without checking two things first: whether it is still enrolled to somebody's organisation, and what its Auto Update Expiration date is. A cheap listing that is past its update date, or still enrolled to a district in another state, is not a bargain. Our guide to Chromebooks that stop receiving updates covers how to look the date up in about fifteen seconds.

The setup that actually works, if you want the short version

Keep the school's Chromebook for school work and accept that the district governs what happens on it — then email the help desk and ask what their filter blocks at home, so you know what you are actually dealing with.

If you want real, granular controls for everything else, they belong on a device you own, with a supervised child account, and with the school account added as a secondary account inside that supervised profile rather than as a separate user on the sign-in screen.

And put the layer you control underneath both: filtering DNS and a device schedule on the router, set once, applying to every screen in the house. That is the piece that is genuinely yours, and it is the piece most families never switch on.

How we can help

We set up home networks across the San Gabriel Valley, Orange County, the Inland Empire and the Coachella Valley, and this is a normal late-August job for us: filtering DNS configured on the router so it covers the whole house, per-device schedules and pauses set up and labelled so you can actually use them, a guest network kept separate, and the family devices sorted into what is supervised and what is not. If you have a school Chromebook in the mix we will tell you honestly which parts of it are out of your hands and stop you spending money on software that cannot run on it.

We do not sell filtering apps or subscriptions, so there is nothing we gain from telling you a product will fix this. If the answer is a five-minute router change and an email to the district, that is the answer you will get.