Workspace Report: Chromebook Powerwash / Enroll / De-Enroll

[Justin_W]

This is one of those things that I feel should be “simple” but I’ve been banging my head against the wall here trying to get it sorted. And Gemini has been acting crazy giving me all sorts of wrong (mostly non-existent) solutions.

I’m just trying to pull a report, for a single (or maybe a couple) of specific Chromebooks that shows how often the following events may have happened over the past couple months: Device power washed, device unenrolled, device re-enrolled.

I have no doubt these events are logged - but I can’t for the life of me decipher the proper conditions/terms to put together what should be a simple report.

Can anyone help?

(Edit for clarity: Looking for this report to be run in the Workspace Admin Dashboard, not 3rd party tools.  If it's worth noting, I have Edu Plus licensing) 

[Scott]

GAM:  

gam report chrome events CHROMEOS_POWERWASH_INITIATED,DEVICE_BOOT_STATE_CHANGE todrive

This will print out a report for powerwashes.  I also included boot state change to flag if a device entered developer mode (or back to verified mode).  For enrolling/unenrolling info I think this might work--

gam report admin events CHANGE_DEVICE_STATE todrive

That will spit out a list of devices changes (disabled, deprovisioned, or activated).  I think that retention time for both of these logs is 6 months.

*edit:  more verbose command for simplified output:

gam config csv_output_header_filter "name,DEVICE_NAME,id.time,EVENT_REASON,NEW_BOOT_MODE,PREVIOUS_BOOT_MODE,ORG_UNIT_NAME,status.eventStatus" report chrome events CHROMEOS_POWERWASH_INITIATED,DEVICE_BOOT_STATE_CHANGE todrive

gam config csv_output_header_filter "name,DEVICE_NEW_STATE,DEVICE_PREVIOUS_STATE,DEVICE_SERIAL,actor.email,id.time,status.eventStatus" report admin events CHANGE_DEVICE_STATE todrive

[Justin_W]

Sorry, I should have specifiedI'm looking to  get this report within the Admin Dashboard - not through GAM.

We don't use/have GAM configured.

[Scott]

Do you have access to the investigation tool?  If so this can be found under chrome log events (event reason contains "powerwash") and admin log events (event is "change chromeos device state").

I would recommend looking into GAM when you have the time--you can get it running in about 30 minutes.

[Justin_W]

Thanks.

I did look into the Investigation tool.

It seems that the Powerwash search is fairly straightforward - how about the others?

I think what we're trying to suss out here is how often a device is being power washed and how long after before it is re-enrolled.

Also, I'm not clear on how far bag the log goes. It's not clear if there's a set/default time period that the tool is restricted to.

[Josh]

Enrolment logs are found in the 'Admin Log' data source.

As Scott suggested above, I'm pretty sure the event is 'CHANGE_DEVICE_STATE'.