Recycled Chromebooks still enrolled in school domain (MDM Locked)

[rachaslaoui]

Hi everyone!

I'm Racha, Product Manager on our ChromeOS team. Hoping to get your feedback on the following topic. Any insight from this community would be phenomenal. 

We have recently learned that a number of Education Chromebooks reaching recycling streams are still enrolled in school domains. 

Since deprovisioning can only be done by the school, this means that refurbishers are not able to refurbish these devices to give them a second life (when still in good condition) and instead have to recycle them for material and parts. 

We're looking for feedback from school admins to understand why this is happening and what we can do to help. More specifically:

• Is this an issue you're familiar with? And if so: why are some Chromebooks disposed of to recyclers while still enrolled? 
• Is it time / staffing related? Product related? Process related? Something else?
• Are there improvements that could be made on the Admin console to potentially help address this issue? 
• Are there improvements that could be made in the disposal process that could help address this issue? (between the school and recyclers for example)
• Are there important considerations we should keep in mind as we investigate a solution?
  

Thank you in advance!

[James_Seymour]

Hi @rachaslaoui,

I don't have any first hand experience of this. We don't have too many managed Chromebooks and when they are EOL/EOS we have a Google Sheet set up to allow us to deprovision them. Our Helpdesk team enter the CBs asset tags into the Google Sheet & select the reason for deprovision and then I run a GAM command agaist this sheet to complete the process.

In the Admin Console you can select multiple devices and deprovision them altogether. It might be helpful if there was a way to apply this to an OU, rather than have to select multiple units. But at the end of the day, someone needs to have to remember to deprovision the CBs before disposing of them. And I imagine that as the process of deprovisioning is not a regular event it is easily forgotton. At the other end, I always forget to purchase the management license for new CBs and only find out when we try to provision them and hit an error.

However, it should be possible to deprovision after they have left the school. I have not tested this but think you would need to set the OU where the CBs are to automatically enrol on powerwash and then deprovision all the CBs. Then the recyclers can powerwash the CB and join a wifi. At which point the CB should try to enrol back into the School but get the instruction to deprovision. This would need to be tested.

Not sure if possible or if it would cause other issues, but if there was an option on the CB to 'requested deprovision', like we have when someone gets a file they do not have access to, so that it promted Admins to deprovision.

Hope this helps.

Cheers

James

[ewikstromSD]

Since deprovisioning is done through Google Admin and makes the device unmanaged, once the device is connected to WiFi, it should deprovision and be able to be powerwashed. Therefore this could be done even after devices are disposed of.

[kszczytko]

I would suspect either a breakdown in communication within the organization, or perhaps schools that are new to chromebooks and don't realize they need to deprovision them first? I'm at a small school, so I'm a department of one. But I can imagine how easy it would be in an IT department with many people how one might think someone else deprovisioned them before packing up the devices for recycling. 

[sujka]

We sell our EOS/EOL devices or damaged devices through govdeals.

What ends up happening, for us, is some devices are broken (screens, boot, ports, keyboard, mouse pad, etc) or just don't plain boot.

So while we deprovision and check all devices that can boot to visually verify deprovisioning there are still devices which can't do that without significant investment of time to try to use a second monitor, plug in keyboard, plug in mouse, troubleshoot damage issues, etc.

So what ends up happening is the vendor fixes those issues and then tries to get the device working but the deprovision command times out (I know it runs or tries to run for a good 30-90 days) but by the time they get around to it it isn't in the queue anymore.

Maybe if there was a way in the console to set an OU to auto wipe/deprovision every time the devices comes up would prevent this.

Mike

[jsb_tech]

My take on this is because many devices that are broken end up being salvaged for parts so components of one Chromebook easily slides into another. But sometimes that includes the top or bottom case where our District tags or Manufacturers SN stamp are and it's easy to lose track where that motherboard went.

I think the problem for us is expediency in the repair process that takes priority over documentation. It's important to do, but it's a lot of overhead when some teacher or kid needs their CB back ASAP. Slingin' screws and silicon boards to get the student/teacher back on track is the game--not marking each part meticulously to keep the recyclers from getting angry.

[Kim_Nilsson]

To make this and many other device related processes easier I created CB_Inventory, a free and open source Google Sheets script, which can list, update and deprovision large numbers of Chromebooks with just a few clicks.

It's really easy to get started too, as all you need is to copy a Sheets template and run it.

[Kim_Nilsson]

Also, it's not really necessary that it's done before the device leaves the organisation, but whoever is doing it needs an account in your Workspace. The account can be assigned a custom admin role, so they can do (almost) only that.

[Kim_Nilsson]

Alternatively, one can always use GAM/GAMADV-XTD3 to deprovision devices.

[Kim_Nilsson]

@rachaslaoui to solve some of the problem, there would need to be a feature where you can upload a CSV of devices (with serial numbers, as that is what most people use, not device-id) and then run an action on them. The main reason for this need is that it is very common that an admin needs to deprovision devices that are spread over a number of OUs, and even if they happen to be in the same OU, you can only select those 50 that are currently visible.

The search/filter capabilities combined with select are too limited in the admin console.

Hence the need to third-party tools, like my CB_Inventory, or GAM-like tools.

[rachaslaoui]

Thank you all so much for the feedback! It's much appreciated! 

[rachaslaoui]

A follow up for all of you: when do you typically retire Chromebooks from your fleet (as soon as they reach AUE, 1-2 years after AUE...)? 

Completely hear you on enabling bulk actions for more than 50 devices but I'm wondering whether it would also make sense to enable admins to configure rules for automatic unenrollment, e.g unenroll devices in designated OU 18 months past AUE? 

[Kim_Nilsson]

Automatic unenrolment based on OU would be nice, but I don't really understand why anyone would allow devices in their organisation after AUE?

Now, I know Chromebooks are very secure devices, but that's only true as long as they are being updated.

After AUE there are no such guarantees, as any kind of bugs and exploits can occur and will not be fixed.

Just like with Mac devices (previously thought to be very secure always), we don't allow use of devices that no longer receive security updates.

Not should private citizens, which is why we don't recommend selling the devices either. We do send them off for recycling though, but my hope is that they are used for parts and not as complete devices.

This is also where I am a bit sad that Chrome Flex isn't readily available for install on any deprecated Chromebook. That would give such old devices a second life for those willing to put in the extra effort.

[sujka]

That is definitely going to be relative to the school based on their replacement cycle (aka funding). We are fortunate enough to remove any and all devices at the end of AUE out of schools. From there it takes about 6-10 months for us to truly get them all back and then in the Summer we resell them.

If there were an OU setting that could trigger automatic powerwash/factory reset and unenrollment that would be a blessing!

P.S. we use a paid product from Amplified (now CDW Education) called Gopher for Chrome to mass updates.

[ewikstromSD]

Google Admin needs to increase the number of bulk actions available. In Microsoft 365, you can bulk reset passwords, bulk deactivate users, etc.

[sampapa]

In our school district (~18,000 Chromebooks) we retire and dispose of any Chromebook just prior to the AUE date.  It took the I.T. department many, many years to convince senior management and school principals that Chromebooks or any electronic device that are no longer supported via hardware or software will be removed from the system.  All devices that are retired are sent to a local recycling facility.  We were always under the impression that they were stripping for the precious metals and not trying to re-use outdated technology.  They are in pretty rough shape after about 5 years.  We also move retired devices into an "INACTIVE" OU and they remain "DISABLED" not "DEPROVISIONED".  The disabled screen provides the message... "This device belongs to school district xyz and is no longer supported or to be used".  This ensures that if someone finds one of our devices they will not be used.  It does not make sense that we retire equipment because it has reached its end of life, but someone else will use it.  If it can still be used, then why did we have to get rid of it in the first place??

[Kim_Nilsson]

"It does not make sense that we retire equipment because it has reached its end of life, but someone else will use it. If it can still be used, then why did we have to get rid of it in the first place??"

That's a very good argument for keeping he device disabled instead of retiring the device.

Allowing some of the hardware to be recycled, but not the actual motherboard in its entirety.

Personally, I would appreciate if it was possible to under own responsibility to install Chrome Flex on retired Chromebooks. Since Flex today can be installed on super-old PC hardware, which is not even close to as secure as a Chromebook, it hurts my soul a little that it's not the first thing done to a retired CB.

[robbabiak]

We have a current stable of 75,000+ chromebooks spread over 220+ sites. We disable them after they reach EOL to prevent them from "coming back into use" within our Division. There was some pushback from Management after our Recycler complained that we were "hindering" their business, but we were more than willing to deprovosion any list of serial numbers provided by recyclers indicating they had disabled systems. There was also a conversation with regards to the morality of sending unpatched systems out that "we knew" were going to be reused. I haven't had a request to deprovision systems after that.