As an admin, you can automatically enroll ChromeOS Flex devices for a faster deployment, instead of using manual credential-based enrollment.
In your Google Admin console, you can choose between two automatic deployment methods: USB installer or Pre-boot Execution Environment (PXE). Using a packaging tool, you embed an enrollment token into a ChromeOS Flex installation image, which automatically enrolls devices into your organization or a specific organizational unit (OU) during initial device setup.
What you need
- Ensure you have an administrator account. For details, see About administrator roles.
- Choose between USB installer or PXE mass deployment.
- For USB installer, ensure you have an 8 GB or more USB drive and access to Chrome browser.
- For both USB installer and PXE boot, ensure you have access to a Debian-based (Debian/Ubuntu) Linux environment, with at least 35 GB of storage. This can be Windows Subsystem for Linux (WSL), Linux on ChromeOS (Crostini), a physical Debian-based Linux machine, and so on.
- The
cros-flex-toolsLinux package (currently Debian-only), which contains tools for ChromeOS Flex deployments. Here are some useful Command-Line Interface (CLI) instructions:
For downloading a ChromeOS Flex image
download_flex_image
download_flex_image [-h] --image_type {usb,mass-deploy} [--output OUTPUT]
Downloads a ChromeOS Flex image.
Flags--image_type {usb,mass-deploy}
(Required) Type of ChromeOS Flex image to download, depending on the intended installation method. For USB installation, choose usb. For PXE-based mass deployment, choose mass-deploy.
--output OUTPUT
File path that the image should be downloaded to. If not specified, a default name is chosen based on the --image_type (for example, flex-image-mass-deploy.bin), and the image file downloads to the current working directory.
-h, --help
Displays a help message and exit.
For packaging the enrollment token and image
package_flex_image
package_flex_image [-h] --image_path IMAGE_PATH --enrollment_token ENROLLMENT_TOKEN (--output OUTPUT | --in_place)
Packages an enrollment token with a ChromeOS Flex image file for automatic enrollment. A device installed with this packaged image enrolls into management without requiring user credentials for authentication.
Flags--image_path IMAGE_PATH
(Required) File path of the ChromeOS Flex image file to package.
--enrollment_token ENROLLMENT_TOKEN
(Required) Generated auto enrollment token in lowercase UUID format (for example, 12345678-90ab-cdef-1234-567890abcdef). Admin Console.
--output OUTPUT
Output file path of the packaged image. You must specify either --output or --in_place.
--in_place
Modifies the input image in-place, rather than outputting a separate packaged image file. You must specify either --output or --in_place.
-h, --help
Displays a help message and exit.
Automatic enrollment (USB installer and PXE boot)
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Devices > Chrome > Enrollment tokens.
Requires having the Chrome administrator privilege.
- At the top, click Enroll.
- Select Non-ChromeOS devices (with ChromeOS Flex) and click Next.
- Choose a deployment method for installing ChromeOS Flex on the devices you want to automatically enroll:
- For USB installer deployment, select Automatic enrollment (USB installer).
- For PXE boot deployment, select Automatic enrollment (PXE boot).
- Click Start and follow the on-screen prompts.
- Click Done.
Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.