How to deprovision Chromebooks safely with GAM

GAM7 deprovisions a Chromebook with one command and two safety catches built in. Here is the preview, the command, the reason you have to choose, and what deprovisioning means for the device afterwards.

Every summer a pile of Chromebooks comes off the carts for good: cracked screens, dead batteries, models past their update date. Deprovisioning takes them out of management so they stop counting against you. It is also the one device action that cannot be casually undone, which is why GAM puts two safety catches in front of it.

The short answer

Find the device first, by serial number:

gam print cros query "id:5CD1234XYZ"

Then deprovision it:

gam cros_sn 5CD1234XYZ update action deprovision_retiring_device acknowledge_device_touch_requirement

The two safety catches

You have to acknowledge it. "As deprovisioning ChromeOS devices is not reversible, you must enter acknowledge_device_touch_requirement". Leave it off and GAM will not deprovision anything. (GAM wiki: ChromeOS Devices)

GAM counts before it acts. "The option max_to_deprov <Integer> can be used to verify the number of devices to be deprovisioned; no deprovisions are processed if the number of devices in <CrOSEntity> exceeds <Integer>". When you pick a device by serial number, the default protects you: "the default max_to_deprov 1 protects you from accidentally deprovisioning more devices than desired."

The documentation also describes the override: "When <CrOSEntity> is derived from an OU, set max_to_deprov 0 and all devices will be deprovisioned." That is a whole organizational unit gone in one command. It has its uses, at the end of a cart's life. Run the preview against the organizational unit first and read every serial number on it.

Choose the reason

Deprovisioning asks why. GAM's actions carry Google's reasons: deprovision_retiring_device for a device leaving your fleet, deprovision_same_model_replace and deprovision_different_model_replace for a device being replaced, and deprovision_upgrade_transfer for moving the upgrade to another device. Pick the one that is true. Disable, deprovision, or delete? explains what each one means for your Chrome upgrade licenses.

What deprovisioned means afterwards

The GAM documentation puts it plainly: deprovisioning means "the device will have to be physically wiped and re-enrolled" before your domain can manage it again. So only deprovision a device you have in your hands or never want back. A lost or stolen Chromebook should be disabled instead, so that it stays yours and useless to whoever has it.

A cart at a time

For a list of retired devices, use a CSV file with a column named serial:

gam csv retired.csv gam cros_sn "~serial" update action deprovision_retiring_device acknowledge_device_touch_requirement

Each row picks out exactly one device, so the one-device limit guards every row.

Sources

  • GAM wiki: ChromeOS Devices — GAM7 documentation. update action, the deprovision reasons, acknowledge_device_touch_requirement and max_to_deprov, and device queries.
  • GAM wiki: Bulk Processing — GAM7 documentation. Running one command per row of a CSV file.

In ORINEX Workspace, deprovisioning, one device or a bulk selection, sits behind a type-to-confirm step, because it is the one device action you cannot simply undo. What ORINEX Workspace does.