ChromeOS Administrator key terms

A Google operating system built on the Linux kernel and Chrome browser technologies, designed for devices managed through cloud policy rather than local imaging, with automatic background updates and verified boot on every startup.

The cloud admin interface in the Google Admin console where administrators configure organizational units, user and device policies, apps, printers, and reporting for ChromeOS and Chrome browser.

The process of registering a ChromeOS device with a domain so it receives device-level policy; forced enrollment and re-enrollment settings prevent use of unmanaged or wiped devices on managed networks.

A pre-provisioning service where device resellers register serial numbers to a customer domain, so devices auto-enroll on first boot without manual interaction or a USB recovery setup.

A device policy that requires a factory-reset device to re-enroll into the same domain before it can be used, blocking circumvention of management by powerwash or developer-mode resets.

Removing a device from domain management so it stops receiving policy; the action can be scoped to the same model, same model and location, or all devices, controlling how easily it re-enrolls.

A local factory reset that wipes user data and returns a ChromeOS device to its initial setup screen while preserving firmware and, if configured, forcing re-enrollment on the next sign-in.

A device state that disables verified boot and allows shell access and custom operating systems; managed fleets usually block it because it undermines platform integrity and policy enforcement.

A startup chain that cryptographically checks firmware, kernel, and system partitions against signed hashes, refusing to boot tampered images and warning the user when integrity checks fail.

The Trusted Platform Module chip that stores device identity keys and protects enrollment credentials and policy state, so a copied disk image cannot impersonate an enrolled device.

A hierarchical container in the Admin console that inherits settings from its parent; policies applied to a child override inherited values and determine which users and devices get which configuration.

The rule that a child organizational unit or group receives settings from ancestors unless it defines its own value, so administrators should place restrictive defaults high and exceptions lower in the tree.

A directory-based collection of users or devices that can receive policy independent of organizational unit placement, letting one account belong to several policy-bearing sets at once.

Settings applied to a signed-in account, such as app availability, browser restrictions, and printing rights, which follow the user across devices rather than binding to hardware.

Settings applied to enrolled hardware regardless of who signs in, covering enrollment restrictions, network configuration, kiosk mode, forced re-enrollment, and power and update behavior.

A programmatic interface for reading and writing ChromeOS and browser policy values, enabling bulk configuration and automation without manual clicks in the Admin console.

A predefined or custom set of privileges assigned to an administrator account, scoping what that person can view or change, such as device management, user management, or reporting only.

A shared-device sign-in mode that applies a defined policy set without requiring individual credentials, commonly used for labs and front desks, with data cleared when the session ends.

A locked-down configuration that runs a single web or Android app full screen on a device, often for signage or point-of-sale, with restricted navigation and automatic restart after failures.

A setting that discards local user data at sign-out so nothing persists on the disk, useful for shared or high-turnover devices where data retention is a risk.

Google's distribution site for extensions and web apps; administrators control which items users may install by allowlisting, blocklisting, or forcing installation through policy.

A policy that silently installs specified extensions for users or devices, pinning them so users cannot remove or disable them, typically used for security or productivity tooling.

A policy listing approved extension IDs; when enabled, users can install only listed items, blocking everything else from the Chrome Web Store or sideloading.

The capabilities an extension requests, such as reading browsing history, accessing site data, or modifying pages; broad permissions warrant review before approval in a managed fleet.

A mobile application delivered to ChromeOS through managed Google Play, where administrators approve apps and control installation and availability per organizational unit.

The enterprise app store used to approve and distribute Android apps to ChromeOS devices, with per-app approval and per-organizational-unit availability controls.

Enrollment of the Chrome browser itself, including on non-ChromeOS platforms, so browser policies and reporting apply to users signed in with managed accounts.

A Chrome protection feature that warns about or blocks phishing, malware, and unwanted software; enhanced mode adds real-time checks and is configurable by policy.

Policy-driven control of which websites and categories users may reach, enforced through URL allowlists and blocklists or an integrated filtering service on managed devices.

An administrator-defined identifier stored on an enrolled device that links it to inventory, ticketing, or asset databases, making fleet records and support requests easier to reconcile.

Settings controlling how and when system updates install, including release channel choice and auto-update pausing, letting administrators balance stability against patch currency.

The update track a device follows, such as stable, beta, or long-term support; channel choice affects feature timing and the support window for a model.

An update track that holds major version changes for a longer period while delivering security fixes, suited to fleets that need predictability over new features.

The date after which a device model stops receiving ChromeOS updates; tracking it prevents running unsupported hardware that no longer receives security patches.

A record of administrative and user actions in the Admin console, showing who changed what and when, used for investigations and compliance evidence.

Fleet visibility in the Admin console covering device inventory, OS versions, installed apps and extensions, and usage, used to find drift and prioritize remediation.

An action issued from the Admin console to a device, such as remote powerwash, reboot, or screenshot capture, used for support and for wiping lost or compromised hardware.

Diagnostic data collected from ChromeOS devices and delivered to the Admin console, including system and browser logs, used to investigate crashes and policy failures.

A troubleshooting view that inspects connectivity, proxy resolution, and certificate trust on a device, helping isolate whether a problem is network, policy, or identity related.