ChromeOS Fundamentals and Device Provisioning
What this domain tests
ChromeOS fundamentals and device provisioning covers the ChromeOS security and update model, the Google Admin console device lifecycle, and the enrollment paths that place a device under management. Expect questions on enrollment methods, organizational unit (OU) placement, policy inheritance, and deprovisioning.
Core rules
- A Chromebook must be enrolled in a Google Workspace or Chrome Enterprise domain before device policies apply. Enrollment creates a device record with a serial or asset ID and places the device in an OU; that OU determines inherited policies.
- Common enrollment paths include manual enrollment with an enrollment token, Zero-touch enrollment preconfigured with a reseller, and forced re-enrollment after a powerwash. Zero-touch requires the device ID to be claimed and assigned to an OU before first boot.
- Device-level settings apply regardless of who signs in; user-level settings follow the user. Child OUs inherit parent settings and can override them. Test both levels when a policy appears not to apply.
- Forced re-enrollment prevents a powerwashed device from being reused with a personal account. Guest mode and developer mode should be blocked deliberately, not assumed blocked.
- Deprovisioning removes the device record and management; it is not the same as a remote wipe or powerwash. Re-enrollment may be required afterward.
- ChromeOS Flex uses the same console but lacks some hardware-backed features found on certified Chromebooks, so verify model support before promising policy parity.
Worked example
A distributor ships 300 Chromebooks. The school wants them to enroll at first boot into the Students OU, force re-enrollment after powerwash, and disable Guest mode. The admin claims the devices with Zero-touch, assigns the Students OU and an enrollment token, sets Forced re-enrollment to Force re-enrollment on that OU, and sets Guest mode to Disabled. Why it works: Zero-touch enrolls automatically at first boot; the token places each device in the correct OU; forced re-enrollment closes the powerwash bypass; Guest mode is a device policy inherited by child OUs unless explicitly overridden.
Traps that cost marks
- Assuming enrollment tokens are global. They are scoped and must be valid for the domain and intended OU.
- Confusing user policy with device policy, then blaming the console when a setting does not apply.
- Forgetting that moving a device between OUs changes inherited policies.
- Treating deprovision as wipe, or wipe as deprovision.
- Assuming ChromeOS Flex is identical to a Chromebook for every security and policy feature.