Mail from Oct 04 2016 discussed toggling which policies work for cloud/ad management (gcm=Google Cloud Management):
- Bool flag not sufficient, we want 3 states (gcm only, ad only, both)
- Extending 'supported_on' to allow chrome_os.gcm/ad/* would be more work to implement and water down the meaning (currently, stuff after the dot is the platform)
Conclusion:
- Introduce supported_cros_management = [ 'gcm', 'ad' ]

Master doc for supported policies:
https://docs.google.com/document/d/1avMSzox18LgDBt7Ordhe02jIeAy8B8xYTGSU6_O2_xM/edit

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6

commit 0bcc67ba5c5023cf77e828b26cebcde5c07cecd6
Author: Lutz Justen <ljusten@chromium.org>
Date: Tue Sep 26 19:24:33 2017

Remove unsupported Chrome OS policies

Introduces a setting in policy_templates.json to specify whether a
Chrome OS policy is managed by Google cloud management ('gc') or by
Active Directory ('ad'). Sets a bunch of policies to 'gc'-only that
don't work for Active Directory (e.g. device reporting, kiosk).

The following changes for 'gc'-only policies:
- The authpolicy daemon, which converts Active Directory GPO to
  policy protobufs, ignores them, see CL:608134.
- They are not included in Chrome OS ADMX templates since they're
  specified with Google's web UI, not through Active Directory GPO.
- Likewise, the HTML docs don't show example values, registry
  locations etc.

BUG= chromium:662417 
TEST=components/policy/tools/template_writers/test_suite_all.py
     Checked ADMX and HTML docs from
     ninja -C out/Release -j 2000 policy_templates

Change-Id: Ib02ae8095c1052efb44a957e47b4b7628a4bdda5
Reviewed-on: https://chromium-review.googlesource.com/677289
Commit-Queue: Lutz Justen <ljusten@chromium.org>
Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Cr-Commit-Position: refs/heads/master@{#504456}
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/resources/policy_templates.json
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/generate_policy_source.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/syntax_check_policy_template_json.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/adm_writer_unittest.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/chromeos_adml_writer.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/chromeos_adml_writer_unittest.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/chromeos_admx_writer.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/chromeos_admx_writer_unittest.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/doc_writer.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/doc_writer_unittest.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/json_writer_unittest.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/reg_writer_unittest.py
[modify] https://crrev.com/0bcc67ba5c5023cf77e828b26cebcde5c07cecd6/components/policy/tools/template_writers/writers/template_writer.py

TODO:
- Uprev protofiles
- Check that in together with CL:608134

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/d943c2b1dcdb366005bb792c378f2d34ff35f9bf

commit d943c2b1dcdb366005bb792c378f2d34ff35f9bf
Author: Lutz Justen <ljusten@chromium.org>
Date: Wed Oct 11 17:53:30 2017

authpolicy: Remove unsupported device policies

Removes a bunch of device policies that got marked as supported for
Google cloud management only, see CL:677289. Since authpolicy is the
policy broker for Active Directory management (it translates GPO to
proto), it should not touch those policies.

CQ-DEPEND=CL:695121

BUG= chromium:662417 
TEST=cros_run_unit_tests --board=amd64-generic --packages authpolicy

Change-Id: I92d6c8d185d13226e3f1f1893ce7e0f7be82a6bd
Reviewed-on: https://chromium-review.googlesource.com/608134
Commit-Ready: Lutz Justen <ljusten@chromium.org>
Tested-by: Lutz Justen <ljusten@chromium.org>
Reviewed-by: Roman Sorokin <rsorokin@chromium.org>

[modify] https://crrev.com/d943c2b1dcdb366005bb792c378f2d34ff35f9bf/authpolicy/policy/device_policy_encoder.cc
[modify] https://crrev.com/d943c2b1dcdb366005bb792c378f2d34ff35f9bf/authpolicy/authpolicy_unittest.cc
[modify] https://crrev.com/d943c2b1dcdb366005bb792c378f2d34ff35f9bf/authpolicy/policy/device_policy_encoder_unittest.cc
[modify] https://crrev.com/d943c2b1dcdb366005bb792c378f2d34ff35f9bf/authpolicy/policy/preg_policy_encoder_unittest.cc
[modify] https://crrev.com/d943c2b1dcdb366005bb792c378f2d34ff35f9bf/authpolicy/policy/device_policy_encoder.h

Verified, authpolicyd fetches and parses Device and User policies using Active Directory GPO:

2018-04-24T14:22:26.681492-07:00 INFO authpolicyd[8343]: #033[41;1;97mReceived 'RefreshDevicePolicy' request#033[0m
2018-04-24T14:22:32.102479-07:00 INFO authpolicyd[8343]: Getting device GPO list for device account
2018-04-24T14:22:44.811438-07:00 INFO authpolicyd[8343]: Device policy fetch and parsing succeeded
2018-04-24T14:22:44.812014-07:00 INFO authpolicyd[8343]: #033[41;1;97mReceived 'RefreshUserPolicy' request#033[0m
2018-04-24T14:22:50.136232-07:00 INFO authpolicyd[8343]: Getting user GPO list for user account
2018-04-24T14:22:59.249760-07:00 INFO authpolicyd[8343]: User policy fetch and parsing succeeded
2018-04-24T14:22:59.250606-07:00 INFO authpolicyd[8343]: All 1 calls to StoreUnsignedPolicyEx succeeded.
2018-04-24T14:22:59.264659-07:00 INFO authpolicyd[8343]: All 1 calls to StoreUnsignedPolicyEx succeeded.

Chrome OS: 10575.12.0
Chrome: 67.0.3396.16
Device: Santa