Powerwash is intentionally available on enrolled Chromebooks to allow TPM firmware updating. There are several conditions, all of which must hold for the powerwash UI (both on the login screen and in chrome://chrome) to be available:

1. The TPM must run an outdated firmware version. More information on version numbers and devices this is relevant for is here: https://www.chromium.org/chromium-os/tpm_firmware_update (check chrome://system for current TPM firmware version)

2. The admin must configure the TPMFirmwareUpdateSettings policy with allow-user-initiated-powerwash = true (check chrome://policy)

Note that once the TPM firmware update is installed, condition #1 no longer holds and the powerwash UI would become inaccessible again.

Please double-check #1 and #2 on the device you're testing with to confirm that the behavior you're seeing isn't actually WAI.

This instance came from one of Caroline dogfooders and the unit was returned to Chrome stop. I was unable to find out any TPM version and TPMFirmwareUpdateSettings policy from the feedback report.

In my Caroline, allow-user-initiated-powerwash is set to "true" but TPM version is up-to-date so condition #1 no longer hold to trigger a powerwash on the login screen.

Thanks for helping put details to c#1, which is very helpful.