Update: Panther updated to M51 as soon as I wiped and re-enrolled the device as a ChromeOS device (https://support.google.com/chrome/a/answer/1360534), so the issue seems to be unique to Cfm mode.

I dont see why DeviceAutoUpdateDisabled would be True if auto updates are set to "Allow auto-updates" in admin console. Could you confirm that this is the case?

Also, is there only 1 organization or do you have multiple OU's in admin console? If more than 1, you need to make sure the given device and the user used for enrolling are in the same OU and the policies are appropriately set for the given OU.

I am not able to repro this with our test accounts.

Yes, Panther device and the user account I used for enrollment both belong to the same OU, which has:

- Auto Update = Allow auto-updates
- Restrict Google Chrome version to at most = No restriction
- Randomly scatter auto-updates over = None
- Release Channel = Move to Stable Channel

in Admin Console > Device management > Chrome devices for meetings > Settings and Policies. This OU has auto updates enabled with no restriction in Device management > Chrome management > Device settings too.

Here is the test username and device serial# in case you want to check backend status: https://drive.google.com/a/google.com/file/d/0B3B7SKCSXU4SS0N0SURIQkxMcWc/view?usp=sharing
FYI my Panther was already updated to M51 when I enrolled it as a ChromeOS device for testing. It was then wiped and re-enrolled as Cfm again, and now DeviceAutoUpdateDisabled is back to True.

Let me know if you need additional information, I can work with customer.

Shared wrong link in #c6...here is the correct one: https://docs.google.com/a/google.com/document/d/1qe_-G7bLIJFh-RPv5IfcqWXkcS_OmxZ3uy9s0iYLcfA/edit?usp=sharing

This seems related to  issue 616620 ? Check further into the update_engine.log and see if there's a firmware update error that's blocking the AU.

Thanks, but I couldn't find any firmware update errors in update_engine.log like https://code.google.com/p/chrome-os-partner/issues/detail?id=54472 (which was dup'ed to  crbug.com/616620 ) so I think this is a different issue.

From update_engine.log in #c1: 
[0621/164646:INFO:subprocess.cc(158)] Subprocess output:
Starting Google_Panther firmware updater v4 (bootok)...
Firmware update (bootok) completed.

+xiyuan@ and deymo@ for ideas.

xiyuan@ could this be related to the version pinning logic you've been working on?

Version pinning code should be in M53. M51 should not be affected. And the code should not be changing the device policy.

It seems that somehow the device received a policy to disable AU:

[0621/164558:INFO:update_manager-inl.h(52)] ChromeOSPolicy::UpdateCheckAllowed: START
[0621/164558:INFO:chromeos_policy.cc(219)] Updates disabled by policy, blocking update checks.
[0621/164558:INFO:update_manager-inl.h(74)] ChromeOSPolicy::UpdateCheckAllowed: END

Update disabled != version pinning.

Updates disabled in that version means that the device policy has the updates disabled. The device policy is fetched by chrome and stored on disk. To recover such device you need a new policy that pins the device from the device policy or otherwise allows it to go to the latest version.

Yeah. We've agreed it has nothing to do with pinning.

The question is why these devices think they have a policy preventing updates while admin console thinks they don't.

Albert, please help find an owner.

xiyuan@ I know you're knee-deep in other stuff, but could I get you to dig deeper into this one?

This looks like caused by AU disabled by policy.

#4, #6 says the AU is not disabled in admin console.

My vague memory says Cfm devices have a separate server UI for policy config (other than cpanel). Are we looking at the right place?

This is due to bug where enforcing "stable channel" -> "auto-update disabled" is not feature protected in Device management server. Hence, as long as the release channel is "stable", even though UI shows auto update is enabled, the device actually gets auto update disabled.

This bug is fixed last week, and the binary containing the fix will be pushed to prod this Wed. After the fix, reboot the device, or reload the policy in chrome://policy page should fix the issue.

Is there a bug number we can dupe this against?

Have a tracking bug in Bugnizer: https://buganizer.corp.google.com/u/0/issues/28848532#comment4

The prod push completed just now, and I verified the fix worked by reloading a device's chrome://policy page.

1) Recovered a panther with 7978.74.0 and enrolled in croste.tv domain.
2) This OU in the cpanel is set to Stable Channel with automatic updates enabled.
3) Verified the device policy details, the flag values are  DeviceAutoUpdateDisabled= "False", Channel = "Stable"
4) After 45 mins, the device upgraded automatically to 8172.60.0.

Hence marking it verified.