ChromeOS Administrator cheat sheet

ChromeOS boots a read-only rootfs verified by dm-verity; any modification to the root partition fails verification and triggers recovery, while user data lives in an encrypted stateful partition.

Enrollment paths: Manual enrollment with a Google Workspace account, forced re-enrollment via the Admin console setting, Zero-touch enrollment (pre-provisioned by a reseller using device serials), and Chrome Enterprise Upgrade licensing is required for management.

Developer mode disables verified boot and allows root shell access; devices in developer mode cannot enroll in a managed domain unless the admin permits it, and enterprise-enrolled devices block developer mode by default.

Powerwash resets the device to factory state, clears the stateful partition and TPM-stored enrollment data; a powerwashed enterprise device re-enrolls automatically only if forced re-enrollment is enabled.

Auto-update policy controls ChromeOS version pinning: AutoUpdateExpiration (AUE) marks the last supported update date per model; admins can pin a target version or allow the latest, but cannot extend past AUE.

ChromeOS Flex runs on certified non-Google hardware; it lacks verified boot with Google-signed firmware, so it supports a reduced policy set and cannot use some features like Android apps or TPM-backed attestation in the same way.

Device provisioning requires network access to Google enrollment endpoints; proxy configuration for enrollment is set at the network level or via a USB Ethernet/proxy setup before the device reaches the enrollment screen.

Kiosk and managed guest session modes are configured per OU; kiosk apps auto-launch without user sign-in, while managed guest sessions allow ephemeral multi-user access with policy applied and data wiped at logout.

Policy precedence: user OU settings override child OU inheritance only when explicitly set; unset values inherit from the parent OU, and the root OU applies to all users unless overridden.

Chrome Enterprise policies for users are delivered via the Admin console to OUs/groups, or via cloud management for browsers; conflicting values resolve by most specific scope (user > group > OU > root) for user-level policy.

Identity: Google Workspace accounts, Microsoft Entra ID via SAML SSO, and third-party IdPs using SAML or OIDC; SSO can be enforced per OU and bypassed for specific URLs or offline scenarios.

Google Identity Services and passwordless: passkeys and security keys are managed under Security > Authentication; admins can require security keys for privileged users and set session length and reauth frequency.

Context-aware access uses access levels (device, IP, user attributes) evaluated by the Access Context Manager; ChromeOS device posture signals feed into access levels for Workspace and third-party apps.

Groups drive policy targeting; nested groups are supported for user policy but the Admin console resolves membership at sync time, so changes may take up to 24 hours to propagate.

Directory sync (Google Cloud Directory Sync or the Admin console directory sync) provisions users and groups from an external directory; deprovisioning rules determine whether suspended users lose device access.

Ephemeral mode and managed guest sessions reduce identity persistence; admins can force sign-out on idle, restrict multi-user sign-in, and disable guest browsing per OU.

App and extension policy is set under Admin console > Devices > Chrome > Apps & extensions; per-OU settings define force-install, allow, block, and force-pin, with force-install taking precedence over block for the same app.

Extension force-install uses the Chrome Web Store update URL (or self-hosted update manifest); force-install by ID plus update URL bypasses the store UI and installs silently.

ExtensionPermissions and blocked permissions: admins can block specific API permissions (e.g., clipboard, fileSystem) per extension, and can require extension allowlisting so only approved extensions run.

Android apps on ChromeOS are delivered via Google Play; admins control Play Store access, app allowlists, and whether sideloading is permitted per OU.

Chrome browser policies (e.g., URLBlocklist, SafeBrowsingProtectionLevel, ExtensionSettings) can be applied to managed browsers via the Admin console or via a cloud management enrollment token for unmanaged devices.

The ExtensionSettings policy is a JSON dictionary keyed by extension ID; it can set installation_mode (force_installed, blocked, allowed), runtime_blocked_hosts, and blocked permissions in one object.

Legacy and Manifest V2 extensions are deprecated; admins should verify extension manifest versions and use the ExtensionManifestV2Availability policy only as a temporary bridge where supported.

Kiosk apps and web apps are configured separately from extensions; web apps can be force-installed and pinned to the shelf, and kiosk apps require a ChromeOS kiosk license per device.

ChromeOS verified boot uses a chain of trust rooted in Google-signed firmware; the TPM stores enrollment and device identity, and remote attestation proves device integrity to Google services.

Chrome Enterprise Premium and security reporting include the Security Investigation Tool, which queries device and user events (login, extension install, malware) with filters and can take action like wiping or disabling.

ChromeOS device reports appear in Admin console > Devices > Chrome > Reports; data includes last sync, OS version, enrollment status, and policy compliance, refreshed roughly every few hours.

Chrome log collection: use chrome://system for device logs, and the Admin console remote commands (remote powerwash, reboot, capture logs) for fleet troubleshooting without physical access.

Common troubleshooting: enrollment failures often stem from licensing, network/proxy, or a device already enrolled to another domain; check the enrollment error code and the device's forced re-enrollment state.

Security keys and FIDO2: enforce security key enrollment for admins, set session duration, and use the security key audit log to detect anomalies; lost keys require admin reset of the user's credentials.

ChromeOS update troubleshooting uses the Release Notes and the Auto Update Expiration date; devices past AUE stop receiving security patches and should be replaced or migrated to ChromeOS Flex where supported.

Reporting for extensions includes extension install and permission events in the Security Investigation Tool; export reports to BigQuery or use the Reports API for long-term retention beyond the console window.

Verified boot chain: firmware verifies kernel, kernel verifies rootfs via dm-verity; failure forces recovery mode, and developer mode disables this chain.

Enrollment requires a Chrome Enterprise Upgrade license per device and a managed Google Workspace domain; Zero-touch uses reseller pre-registration of serial numbers.

Forced re-enrollment binds a device to its domain after powerwash; disabling it allows the device to be re-enrolled elsewhere or used unmanaged.

Auto Update Expiration (AUE) is a per-model date after which no more ChromeOS updates are delivered; policy cannot extend it.

ChromeOS Flex runs on certified third-party hardware with a reduced feature set and no Google-signed firmware verified boot.

OU inheritance: a child OU inherits unset policies from its parent; explicitly set values override the parent for that OU only.

SSO via SAML/OIDC can be enforced per OU; admins configure IdP metadata, SSO profile, and can allow password fallback or block it.

Access levels in Access Context Manager combine device posture, IP, and user attributes; ChromeOS posture signals include OS version and encryption status.

Group-based policy targeting resolves nested membership at sync time; propagation delays up to 24 hours are normal.

Session controls: idle timeout, reauthentication frequency, and multi-user sign-in restrictions are set per OU under Security.

Force-install beats block for the same extension ID; installation_mode in ExtensionSettings is the authoritative per-extension control.

ExtensionSettings JSON supports force_installed, blocked, allowed, and removed modes plus runtime_blocked_hosts and blocked permissions.

Android apps come from Google Play; admins control Play access, app allowlists, and sideloading per OU.

Web apps can be force-installed and pinned to the shelf; kiosk apps need a ChromeOS kiosk license per device.

Manifest V2 extensions are deprecated; ExtensionManifestV2Availability is a temporary bridge where supported.

The Security Investigation Tool queries device and user events with filters and supports actions like disabling users or wiping devices.

Device reports in Admin console show last sync, OS version, and compliance; refresh cadence is roughly every few hours.

Remote commands (reboot, powerwash, capture logs) let admins troubleshoot enrolled devices without physical access.

Enrollment failures commonly trace to missing licenses, proxy/network blocks, or a device already bound to another domain.

Devices past AUE receive no security patches and should be replaced or migrated; check the model's AUE date before planning refreshes.