ChromeOS Administrator flashcards
ChromeOS Administrator · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- dm-verity
- A Linux kernel feature ChromeOS uses to hash-verify the read-only root filesystem at boot; any tampering fails verification and sends the device to recovery mode.
- Verified boot
- ChromeOS chain of trust where Google-signed firmware verifies each boot stage up to the rootfs; developer mode disables it, and enterprise devices block developer mode by default.
- Zero-touch enrollment
- A provisioning method where a reseller pre-registers device serial numbers to a customer domain, so devices auto-enroll on first boot without manual entry of credentials.
- Forced re-enrollment
- An Admin console setting that binds a device to its domain after powerwash, causing automatic re-enrollment and preventing the device from joining another domain.
- Powerwash
- A factory reset that wipes the stateful partition and TPM-stored enrollment data; on enterprise devices it triggers re-enrollment only when forced re-enrollment is enabled.
- Auto Update Expiration
- The per-model date after which ChromeOS stops delivering updates to a device; administrators cannot extend it through policy and should plan hardware refresh or migration.
- ChromeOS Flex
- A ChromeOS variant for certified third-party hardware; it lacks Google-signed firmware verified boot and supports a reduced feature set compared with Chromebooks.
- Kiosk mode
- A ChromeOS session type that auto-launches a single app without user sign-in; it requires a ChromeOS kiosk license per device and is configured per organizational unit.
- Managed guest session
- An ephemeral multi-user ChromeOS session where policy applies but user data is wiped at logout; useful for shared devices such as lab or front-desk machines.
- OU inheritance
- Policy behavior where a child organizational unit inherits values from its parent unless the child explicitly sets its own value, which then overrides the parent.
- SAML SSO enforcement
- A per-OU setting that redirects users to a third-party identity provider for authentication; administrators can block password fallback to require SSO.
- Access Context Manager
- A service that builds access levels from device posture, IP range, and user attributes; Workspace and third-party apps evaluate these levels for context-aware access.
- Group-based policy targeting
- Applying Chrome policies to Google Groups instead of organizational units; nested membership resolves at sync time, so changes can take up to 24 hours.
- Idle timeout policy
- A per-OU security setting that signs users out after a period of inactivity; related controls include reauthentication frequency and multi-user sign-in restrictions.
- Directory sync
- A process that provisions users and groups from an external directory into Google Workspace; deprovisioning rules determine whether suspended users lose device access.
- Security key enforcement
- A policy requiring FIDO2 security keys for sign-in, often applied to privileged accounts; lost keys require an administrator to reset the user's credentials.
- Ephemeral mode
- A ChromeOS user setting that discards local user data at sign-out, reducing persistence on shared or high-security devices while retaining policy enforcement.
- ExtensionSettings policy
- A JSON dictionary keyed by extension ID that sets installation_mode, runtime_blocked_hosts, and blocked permissions, giving administrators per-extension control on managed browsers.
- Force-install precedence
- A rule where force-installing an extension overrides a block for the same extension ID; installation_mode is the authoritative per-extension control.
- Extension allowlisting
- A configuration that permits only approved extensions to run; unlisted extensions are blocked, and specific API permissions such as clipboard or fileSystem can be denied.
- Android app management
- Control of Google Play access, app allowlists, and sideloading per organizational unit for Android apps running on ChromeOS devices.
- Web app force-install
- Pushing a web app to managed users and optionally pinning it to the shelf; configured separately from extensions in the Admin console Apps and extensions section.
- Manifest V2 deprecation
- The phase-out of legacy extension manifest versions; ExtensionManifestV2Availability serves only as a temporary bridge where the platform still supports it.
- URLBlocklist policy
- A Chrome browser policy that blocks navigation to listed URL patterns for managed users and browsers; related policies include URLAllowlist for exceptions.
- Safe Browsing protection level
- A browser policy setting that controls Safe Browsing behavior, from standard to enhanced protection, applied to managed Chrome browsers and ChromeOS users.
- Cloud management enrollment token
- A token that enrolls unmanaged Chrome browsers into cloud management so browser policies can be applied without a ChromeOS device or domain-joined machine.
- Security Investigation Tool
- An Admin console console for querying device and user events with filters and taking actions such as disabling users or wiping devices.
- Device reports
- Admin console data showing last sync, OS version, enrollment status, and compliance for ChromeOS devices, refreshed roughly every few hours.
- Remote commands
- Admin console actions such as reboot, powerwash, and log capture that let administrators troubleshoot enrolled ChromeOS devices without physical access.
- Remote attestation
- A TPM-backed process where a ChromeOS device proves its integrity and identity to Google services, supporting enrollment and enterprise security decisions.
- Enrollment failure causes
- Common causes include missing Chrome Enterprise Upgrade licenses, proxy or network blocks to enrollment endpoints, and devices already bound to another domain.
- Reports API export
- A method to pull ChromeOS and extension event data into BigQuery or another store for retention beyond the Admin console reporting window.