Strengthening Highlights and preventing student loopholes Follow

This article helps Hāpara administrators strengthen Chrome and ChromeOS settings so students cannot bypass Highlights using Incognito mode, Guest mode, multiple accounts, DevTools, bookmarks, Chrome internal URLs, Google Lens or virtual desktops.

In this article:

• Diagnostic table
• Force-install Hāpara Highlights
• Disallow incognito mode
• Disable guest browsing (browser and device)
• Force Chrome browser sign-in
• Block multiple account sign-in on ChromeOS 
• Prevent students from ending Chrome processes
• Limit developer tools
• Reduce bookmark and bookmarklet loopholes
• Block sensitive internal Chrome URLs 
• Disable Google Lens for student OUs
• Review multiple desktops or virtual desks
• Use ephemeral mode on shared devices
• Troubleshooting 
• Related articles

Summary

To prevent students from bypassing Hāpara Highlights, apply the recommended Google Admin Console policies to student organizational units, force-install the Highlights extension and verify that each policy is active on a managed student device. Start with the diagnostic table below to identify the likely loophole, then apply the matching prevention setting.

Before you begin

You need:

1. Google Admin Console access.
2. Student organizational units set up in Google Admin.
3. The Hāpara Highlights extension force-installed for student users.
4. A managed student Chromebook or managed Chrome browser for testing.
5. A test student account in the same OU as your students.

Apply these settings to student OUs first. Keep staff OUs separate so teachers and IT staff can retain tools such as DevTools or Incognito where needed.

Diagnostic table: identify and close common Highlights loopholes

Prevention playbook

1. Force-install Hāpara Highlights

Force-installing Highlights helps ensure the extension is present and cannot be removed by students.

1. In Google Admin Console, go to Devices > Chrome > Apps & extensions.
2. Select the student OU.
3. Add or select Hāpara Highlights.
4. Set the installation policy to Force install.
5. Pin the extension to the browser toolbar if that option is available.
6. Click Save.

2. Disallow Incognito mode

Incognito mode can prevent required extensions and policies from applying as expected.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Security > Incognito mode.
4. Select Disallow incognito mode.

1. Click Save.

3. Disable Guest browsing

Guest browsing allows students to use Chrome without their managed school profile.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Security > Browser guest mode.
4. Select Prevent guest browser logins
   
   
5. Then go to Device settings > Sign-in settings > Guest mode.
6. Select Disallow guest mode.
7. Click Save.

4. Force Chrome browser sign-in

Forcing browser sign-in helps ensure students are using a managed browser profile where district policies apply.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Sign-in settings > Browser sign-in settings.

4. Select Force users to sign in to use the browser.
   
   

    

5. In Restrict sign-in to pattern, enter your school domain pattern.

Example:

.*@district\.org

       6. Click Save.

5. Block multiple Google account sign-in

Students may try to add a personal or secondary Google account to avoid school policies.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to User experience > Multiple sign-in access.

4. Select Block multiple sign-in access for users in this organization.

   
   

5. Click Save.

6. Prevent students from ending Chrome processes

Students may try to use Chrome Task Manager to end the Highlights process.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Task manager.
4. Select Block users from ending processes with the Chrome task manager.
   
   
    
5. Click Save.

7. Limit Developer Tools

Developer Tools can be used to inspect or interfere with extensions.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Developer tools.
4. Choose one of the following:
   • Allow use of built-in developer tools except for force-installed extensions — recommended if students need DevTools for coding classes.
   • Don’t allow use of built-in developer tools — recommended if students do not need DevTools.
     
     
      
5. Click Save.

8. Reduce bookmark and bookmarklet loopholes

Bookmarklets are browser bookmarks that contain JavaScript. Students may use them to interfere with browser behavior or classroom sessions.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Bookmark bar.
4. Select Disable Bookmark bar.
5. Go to Bookmark editing.
6. Select Disable Bookmark editing.
7. Optional: Use Managed bookmarks to provide approved learning resources.
8. Click Save.

9. Block sensitive internal Chrome URLs

Chrome internal URLs can expose settings or tools students should not access.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Content > URL blocking.
4. Enable Block sensitive internal Chrome URLs.
5. Add only additional URLs your district has confirmed as a risk.
   
6. Click Save.

Use caution before manually blocking Chrome URLs. Blocking the wrong internal URL may interfere with normal Chrome or ChromeOS functionality.
 

10. Disable Google Lens for student OUs

Google Lens may allow students to search screen content, images or assessment questions.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Search for Google Lens.
4. Set the available Google Lens options to disabled or hidden, including:
   • New tab page Google Lens button: Do not show
   • Google Lens camera-assisted search: Disabled
   • Google Lens region search: Disabled
   • Google Lens overlay: Disabled
5. Click Save.

For high-stakes assessments, remind staff that browser controls cannot prevent students from using a separate personal device.

11. Review multiple desktops or virtual desks

ChromeOS virtual desks may allow students to move activity out of immediate view during in-person supervision.

1. Test virtual desk behavior using a student account.
2. Confirm whether teachers can still see the active screen in Highlights.
3. Set classroom expectations for virtual desk use.
4. Consider pairing this with Focus or Filter sessions during assessments.
5. Escalate to Hāpara Support if student activity appears hidden even when policies are applied correctly.

12. Use ephemeral mode on shared devices

Ephemeral mode clears local user data when the student signs out. This can reduce cached profile issues on shared carts, labs or library devices.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the shared-device student OU.
3. Go to Security > Force ephemeral mode.
4. Select Erase all local user data.
   
5. Click Save.

Use this carefully. Do not apply it to staff OUs or users who need persistent local profiles.

Troubleshooting

The policy is set, but students can still access the setting

Check that the student is in the correct OU. Then open chrome://policy, reload policies and confirm the policy status is OK.

The student is using a personal device

These settings apply only to managed Chrome browsers or managed ChromeOS devices where the student signs in with a school account. For unmanaged personal devices, use your district’s device policy, network filtering and classroom procedures.

Teachers still see students as Offline or missing

This may not be a loophole issue. Check extension installation, student sign-in status, network access and Highlights connectivity.

A setting affects a class that needs coding tools

Apply the stricter policy to most student OUs, then create a separate OU or group for approved coding classes. For those students, allow DevTools except for force-installed extensions.