Google Admin Console : Erase Local Data

[TechMonkey]

Nope, and we have had further issues so just collecting them all up and ensuring they are updated and powerwashing the lot of em.

[PotNoodleTech]

For some inexplicable reason, if you enable the erase local data on the chromebooks, every user that logs in then only gets 2GB alocated disk space to use for that session. That includes installing any apps or extensions that get installed and anything else to do with their user profile.

 

That basically makes it unusable if you ahve quite few apps or extensions the kids are using.

 

For that reason, we turned the setting off and have never had any disk space issues since!

[TechMonkey]

For some inexplicable reason, if you enable the erase local data on the chromebooks, every user that logs in then only gets 2GB alocated disk space to use for that session. That includes installing any apps or extensions that get installed and anything else to do with their user profile.

 

That basically makes it unusable if you ahve quite few apps or extensions the kids are using.

 

For that reason, we turned the setting off and have never had any disk space issues since!

 

Yep we found this and that some apps didn't work so turned it off, but we are still getting full drives. Old profiles don't seem to get removed and the System partition seems to fill up a lot! We have just had to go through and power wash all the Chromebooks and made sure they are al up-to-date so hoping that helps.

[jthompson]

I powerwashed one of our trolleys just before half term, and all of the devices reported about 6% full after doing that. Just checked the same ones today (so literally just a few days of use) and around half are up to 80-90% full. We have the erase all local user data setting enabled for these devices. W T F, man.

 

I wanted to see if preventing the Google Play Services installation at each login on these devices would do anything, but I think that's a user setting rather than a device settings (Android apps are allowed on our user OU, but not allowed on the device OU). I don't particularly want to turn off Android apps for all students, in case they're using them on their own devices, but I think I may have to try it.

 

Maybe our students aren't actually signing out, and ChromeOS onyl purges profiles if it's a user-initiated sign out?

Edited November 4, 2021 by jthompson

[j224]

I powerwashed one of our trolleys just before half term, and all of the devices reported about 6% full after doing that. Just checked the same ones today (so literally just a few days of use) and around half are up to 80-90% full. We have the erase all local user data setting enabled for these devices. W T F, man.

 

Have you reported that to Google? Something is definitely not working correctly.

 

We only have two Play Store apps assigned to users, so it can't be related to that. Our users all save downloads to the Google Drive and even if they saved it locally, VERY VERY little is downloaded so would not be eating up GB's of storage in such a short time frame. We used shared Chromebooks for 6 years without the drives getting anywhere near full.

[jthompson]

After testing this out pretty exhaustively, I've come to the conclusion that the 'Erase all local user data' doesn't actually do anything. It doesn't appear to remove any user data at all, which would explain why Chromebooks with this setting applied are filling up just as much as if they didn't have it applied.

 

Test device is in an OU with the 'Erase all local user data' setting applied. Profiles cleared from the console. Disk usage at 10% (1.97GB).

Test user in a wholly separate OU, with the 'Android applications on Chrome devices' setting set to 'Do not allow'. Google Play Store therefore does not install after login.

After copying a 640MB file into the local storage for that user, the device's disk usage goes up by the same amount (using 'Capture Logs' from the dashboard to refresh the device info).

After signing the user out, the disk usage does not go back down at all. Signing the same user back in reveals that the 640MB file is still there. The profile has not been cleared..

 

For a different test user, one with 'Android applications on Chrome devices' setting set to 'Allow', the picture is the same. Google Play Store will install after the first sign in, with disk usage going up around 100MB or so as a result, but subsequent sign-ins don't see Google Play Store installing (it's already present). Locally stored files remain in place.

 

I've also tried it with the 'Erase all local user data' setting applied to the user as well, just in case, but it makes no difference.

 

Resetting the device to clear profiles from the dashboard does clear these profiles out as advertised, but I've noticed that for devices that are already nearing full, that doesn't work. Only a Powerwash is able to reclaim storage from nearly full devices.

 

Edit: Will raise Google support to report all this to them and see what they suggest.

Edited November 4, 2021 by jthompson

[j224]

Well done for testing so thoroughly! Interesting that the 'Erase all local user data' doesn't appear to do anything.

 

But the question remains, what is actually filling up the storage? Is it just a bug that makes the Chromebook think that it's full?

[OverWorked]

I'm having the same issue at one of my Primary Schools, but it's not new - it also happened about two years ago. The only solution last time was to power wash the Chromebooks.

 

There are about 200 pupils using about 40 Chromebooks. Each Chromebook typically has 20+ profiles on it.

 

I'd assumed that the profiles weren't getting deleted because they weren't old enough - like there was some minimum time limit before a profile could be deleted. I only visit that school once a week so I can't get hold of one of the devices right now.

 

So has everyone else found that the erase all data has no effect?

[paulkerton]

I'm having the same issue at one of my Primary Schools, but it's not new - it also happened about two years ago. The only solution last time was to power wash the Chromebooks.

 

There are about 200 pupils using about 40 Chromebooks. Each Chromebook typically has 20+ profiles on it.

 

I'd assumed that the profiles weren't getting deleted because they weren't old enough - like there was some minimum time limit before a profile could be deleted. I only visit that school once a week so I can't get hold of one of the devices right now.

 

So has everyone else found that the erase all data has no effect?

 

Quite the opposite. Erase local data does work, but Google don't recommend it as the Chromebook is supposed to do profile managment as part of it's process, which is where the difficulties seem to lie.

[j224]

Quite the opposite. Erase local data does work, but Google don't recommend it as the Chromebook is supposed to do profile managment as part of it's process, which is where the difficulties seem to lie.

 

Apart from jthompson's tests at the top of this page, which showed that 'Erase local data' didn't seem to do anything.

[paulkerton]

Apart from jthompson's tests at the top of this page, which showed that 'Erase local data' didn't seem to do anything.

 

Which is strange, because it has done and continues to for us.

[OverWorked]

I've sone some experimenting and found that:-

 

* Setting erase local data on a device that is already full does not clear disk space. It seems to hide the other profiles, but not actually delete anything. Is it possible that it does not apply retrospectively to profiles that existed before the policy was applied?

 

* Reset device - clear user profiles (not a full factory reset) from Google Admin Console doesn't clear any space either.

 

* There are two places to set erase local data:-

1) User settings, Force ephemeral mode

2) Device settings, User data

 

I've tried all the above in various settings on a device with full storage and none of them clear space.

 

Next thing to try is set erase local user data (either device or user or both) then power washing and see how it goes from there.

[jthompson]

Next thing to try is set erase local user data (either device or user or both) then power washing and see how it goes from there.

 

I've tried that here with the setting applied at both the device and user OUs, after powerwashing, and it still didn't work.

 

I do wonder if there's something in our environment - web filtering upsetting TLS for some function or other, perhaps? I might take a Chromebook home to test it there.

[rogerdnixon]

The setting does work - but it might not do what you think it does (to be fair the description is not entirely clear). The setting is only suitable for heavily multiuser devices - so for us day loan Chromebooks, where the student forgets their own. The setting will remove the user on logoff or power down. IT also locks the free storage at about 2Gb - varies a little on the machine - but that all you will ever get (this is not explicitly stated in any documentation - but Google told me some time ago that's how it worked). So fine for quick ah-hoc use - but not if you have users with loads of extensions or Android apps.

 

So the situations you might use this setting are quite narrow. The use case mentioned above or say at a primary where you are using QR codes to login (its required then) - that's it for us. Don't use on the regular trolley - leave ChromeOS to do its stuff and manage the space. If that does not work, you can wipe user profiles to release space directly from the admin console or use GAM to do it in bulk or even script it to happen every so often.

 

So my advice would be to not use the setting unless you are using QR codes. However, you can use the setting to hide profiles - so you just get a login screen and not a long list of users.

[jthompson]

It doesn't work here at present. Profiles aren't removed at logoff or shutdown/restart. Clearing profiles from the Admin console also isn't working for devices that are full or nearly full. None of our users have loads of extensions of Android apps (we have a pretty tight allowlist for those), so having a max profile size limit isn't going to impact us, tbh.

 

With the setting disabled, as per Google's recommendation, devices just fill up. Chrome OS doesn't do its stuff.

[rogerdnixon]

That's not expected behaviour. Raise a support ticket and Google will look at your policies and determine what is wrong.

[OverWorked]

- leave ChromeOS to do its stuff and manage the space. If that does not work, you can wipe user profiles to release space directly from the admin console or use GAM to do it in bulk or even script it to happen every so often.

 

Thanks. That's interesting and will stop me wasting time on something that won't work.

 

The trouble is that none of the rest works either: leaving ChromeOS to manage the space, or wiping profiles from GAM.

 

Short of a power wash done from the device, nothing will free up space.

 

I'll leave "erase local user data" turned off, and raise a ticket with Google.

 

It looks like I've got the same situation as @jthompson and a few others here.

[jthompson]

It's good to know that it is working for some people (either with erase local data on or off), so worth investing more time to try to put right.

[j224]

Yeah, several of us have raised tickets. I did just before the summer holidays and they asked me to collect log files, which I couldn't do on the Chromebooks which were full because they were too full to generate or save the log file.

 

So until they figure out what's wrong, I've just been 'powerwashing' the ones I come across with the issue.

[DavR]

We ran into this just before the half term holiday.

 

Turning on "erase local user data" does not work retrospectively, and Chrome OS is not managing user profiles adequately on it's own. The only way I could make these devices usable again was a full factory reset.

 

All of our devices are trolley-based multi user devices, so I've put "erase local user data" on and will leave it on for the foreseeable future I think.

[jthompson]

Interestingly, I'm running the same test again today that I was running the other day, and the DeviceEphemeralUsersEnabled policy (aka Erase all local user data) does now appear to work as advertised.

 

The Chromebooks I'm testing with have had an OS update since the other day, so I might dig out one that hasn't yet and see if it's the OS update making a difference.

[OverWorked]

I've had a response from Google support. The pupils just close the lid when finished which does not log them out, so the profiles don't get cleared.

 

I'll powerwash all the Chromebooks, then set only the action on close lid. I won't set "Erase local user data" yet as it shouldn't be necessary. With the accounts logged out the ChromeOS should be able to clear old ones.

 

From Google support:-

 

In order to force local data to be cleared you will first have to force a log out on devices. To do this you will have to modify two policies inside of your Admin Console.

 

This Policies are " Idle Settings" inside of "User & Browser Settings" and "User Data" inside of "Device Settings". I will break down below the modification for each policy below:

 

Forcing a Log Out:

 

1. Next From the Admin console Home page, go to Devices.

2. On the left, click Chrome browser management.

3. Click "User & Browser Settings"

4. Select the correct organizational unit you want to modify (This is the users OU or anyone else you want to affect)

5. Look for the option called " Idle Settings" and change the option "Action on lid Close" from sleep to "Log Out"

 

Forcing Data to be cleared:

 

1. From the Admin console Home page, go to Devices.

2. On the left, click Chrome browser management.

3. Click Device Settings

4. Select the correct organizational unit you want to modify (remember that this is a Device Setting Policy therefore it has to be modified in the OU for the devices that the users use and not where the users are)

5. Look for the option called "User Data" and change it to " Erase Local User Data"

6. Click Save

 

Once you have changed this setting and students close the lid of the Chromebook this will log him/her out of the Chromebook and then the other policy will be enforced to erase the local data.

[Primus]

I've had a response from Google support. The pupils just close the lid when finished which does not log them out, so the profiles don't get cleared.

 

I'll powerwash all the Chromebooks, then set only the action on close lid. I won't set "Erase local user data" yet as it shouldn't be necessary. With the accounts logged out the ChromeOS should be able to clear old ones.

 

From Google support:-

 

Ours all log out and it still doesn't clear them.

 

We've seen it on single user devices!

[OverWorked]

Ours all log out and it still doesn't clear them.

 

We've seen it on single user devices!

 

 

I was getting my hopes up.

[jthompson]

That's interesting about profiles not signing out. I wonder if restarting the device would sign out all such users and clear their profiles.

 

I'm not sure I'd want users signed out on a lid close, though, if it could be helped. Students cotton on to that and they'll be slamming their classmates' lids down for fun. It would also apply to any personally owned Chromebooks, which might be a little annoying for them.

Edited November 10, 2021 by jthompson