The problem
Frontline work doesn't look like office work. A store associate, a warehouse picker, a clinic receptionist or a hotel desk clerk needs a screen for ten minutes, then hands it back. The device lives on a shelf, in a cart or on a counter. Nobody owns it. That shape breaks most laptop management assumptions.
The usual answer is a shared Windows PC with one login for the whole site, or a personal account on a tablet. Both drift. Files pile up in the Downloads folder, the browser stays signed in as the last person, updates wait for a reboot that never comes, and the local admin password ends up on a sticky note. When a unit dies, nobody can tell you its name, its warranty or its replacement date.
Chromebooks fit this shape because the system verifies itself at boot and user data lives in a cloud profile rather than on the disk. Sign out and the machine holds almost nothing. That makes sharing practical, but only as a managed fleet. Out of the box, a Chromebook is a consumer machine that will happily let a stranger sign in with a personal Gmail account.
What a good solution looks like
Every device should be enrolled in the Google Admin console under Chrome Enterprise Upgrade, a per-device annual license. That license is what gives you policies, forced re-enrollment and remote wipe. Without it you have a pile of laptops, not a fleet.
Pick a sign-in model per station. Managed Guest Session suits a counter or cart device: each user gets a clean profile, policies apply, and everything is wiped at sign out. Kiosk mode suits a single task such as badge printing, a time clock or patient check-in: the app launches at boot and there is no desktop to wander into. Named accounts on assigned devices suit staff who take the same unit every shift and want their own bookmarks.
Then set policy to match. Guest mode off. Sign-in restricted to your domain. Idle timeout and automatic sign-out so a session doesn't sit open on a counter. Developer mode blocked, external storage blocked where it makes sense, a short approved list of apps and extensions per org unit. Pin ChromeOS versions and roll updates on your schedule rather than whenever they ship.
Treat peripherals as part of the purchase. Receipt printers, label printers, badge readers and scanners are the usual reason a pilot stalls. Confirm each one works from inside a managed guest session before you buy in volume.
How to build it
Check the Auto Update Expiration date on any model you're considering. Every Chromebook has one and it's published. A cheap unit with three years left costs more over its life than a mid-range one with five. Record the date in your inventory next to the serial number.
Build the Admin console structure before the hardware lands. Create org units by site, then by role: kiosk, shared counter, assigned. Put the shared unit on Managed Guest Session, the kiosk unit on auto-launch with a single app, and apply base policy at the top so everything inherits it. Turn on forced re-enrollment and sign-in restriction first, because those two are painful to retrofit.
Enroll. For a small fleet, press Ctrl+Alt+E at the sign-in screen and authenticate with an admin account. For a larger one, ask the reseller about zero-touch enrollment with a pre-provisioning token, which ships devices already tied to your domain. Name each unit by site and slot before it leaves the desk, for example STORE14-FLOOR-02, and put the asset tag on the lid where staff can read it.
Test the station the way a user would. Check sleep behavior on a plugged-in counter device, print from inside a managed guest session, run the kiosk app through a full shift, and watch what happens when the screen locks. Tape a one-page card to the shelf: sign out, wipe the screen, charger goes here.
Risks and how to manage them
Auto Update Expiration is the risk to track. When a model reaches its date, ChromeOS updates stop, including security fixes. The device still turns on, which is exactly what makes it easy to forget. Keep the dates in the same sheet as serials and warranty, and start replacement planning a year ahead.
Watch licensing drift. Each managed device holds a license. When a unit is lost, stolen or scrapped, deprovision it in the console or you keep paying for hardware you no longer have. Forced re-enrollment means a wiped device can't be set up again by whoever finds it.
Check workflow gaps early. A Chromebook runs web apps and Android apps. If the job depends on a Windows desktop application, your options are a virtual desktop, a web front end, or leaving one Windows machine at that station. Decide before the pilot, not after.
Cover the network and the repair path. A cloud-first device on a weak Wi-Fi spot is a dead terminal, so test where the carts and counters actually sit. Buy spares: one extra unit per ten, plus a warranty with next business day swap. Mailing a device out for three weeks empties a cart.
How to measure success
Measure what the frontline feels. Time from lid open to a usable session at shift change. Tickets per hundred devices per month, split by sign-in, printing and connectivity. Swap and repair turnaround. Kiosk uptime for each single-purpose station.
Measure the fleet as well. Devices active in the last 30 days against licenses purchased. Units that haven't been seen in a month. Devices within twelve months of Auto Update Expiration. Policy exceptions per site and how long each has been open.
If the inventory and refresh dates need settling before you pick models, a structured review can help. Cloudverg's Hardware and endpoint review is a fixed price of $4,500 over two weeks: an inventory of endpoints, servers, network gear and licenses, a standard device spec per role, supplier lead times and a three year refresh plan with quantities. It is one option among several, and a reseller quote plus a Workspace admin can cover part of the same ground.
Frequently asked questions
Can multiple staff share one Chromebook safely?
Yes, if the device is managed. A Managed Guest Session gives each person a clean profile that wipes at sign out, and policies stop local file saves and personal account sign-ins. Without those settings, a shared Chromebook keeps browser history and downloads for the next person.
Do Chromebooks need a license to be managed?
Yes. Chrome Enterprise Upgrade is a per-device annual license that puts the machine under the Google Admin console. Without it the device works, but you can't push policies, force re-enrollment or wipe it remotely.
What happens when a Chromebook passes its Auto Update Expiration date?
ChromeOS updates stop, including security fixes. The device keeps working, so move it off sensitive work and plan a replacement. Check the date before you buy, because a model with a short runway costs more over its life than one with five years left.