Force wiped Chrome devices to re-enroll

For administrators who manage Chrome devices for a business or school.

By default, wiped or recovered Chrome devices are forced to re-enroll into your domain. Re-enrollment ensures that the devices remain managed and policies you set are enforced on the device.

Considerations

• Don’t force devices that are used in developer mode to re-enroll. Instead, put them in a different organizational unit and turn off forced re-enrollment for that organization.
• If a device is no longer going to be managed by your domain, you should deprovision the device instead.

When forced re-enrollment is turned on...

The user has to re-enroll the device before they can use it. If they don't, they can't sign in, browse in guest mode, or see the consumer sign-in screen.

Turn forced re-enrollment on or off

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to DevicesChrome management.
3. Click Device settings.
4. To apply the setting to all devices, leave the top organizational unit selected. Otherwise, select a child organizational unit.
5. Configure the Forced Re-enrollment setting:
   • To turn it on, select Force device to automatically re-enroll into this domain after wiping.
   • To turn it off, select Device is not forced to re-enroll after wiping.
6. Click Save.

Settings typically take effect within minutes, but it might take up to an hour to propagate through your organization.

Automatic re-enrollment

Chrome version 75 and later

Automatic re-enrollment lets wiped devices automatically re-enroll into your domain without users having to enter their user name and password. The feature will roll out over a few weeks and become the default behaviour for wiped devices.

To stop automatic re-enrollment becoming the default behaviour for your devices,  you need to turn off automatic re-enrollment.

Note: Sometimes, devices might not be able to automatically re-enroll themselves. If that happens, users are prompted to manually re-enroll devices.

During the roll-out phase (before automatic re-enrollment becomes the default), you can choose to opt in or out of automatic re-enrollment:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to DevicesChrome management.
3. Click Device settings.
4. To apply the setting to all devices, leave the top organizational unit selected. Otherwise, select a child organizational unit.
5. Configure the Forced Re-enrollment setting:
   1. To opt in to automatic re-enrollment, select Force device to automatically re-enroll into this domain after wiping.
   2. To opt out of automatic re-enrollment , select Force device to re-enroll with user credentials into this domain after wiping.
6. Click Save.