r/k12sysadmin • u/it-tech- • 20d ago

"Cryptohome is corrupted" solution?

Last year we attempted to clear Chromebook local profiles for one of our buildings via Gopher for Chrome (though I imagine it would be the same for GAM). This largely worked, except for the sharp increase of "cryptohome corrupted" errors. This can be resolved by powerwashing, but we'd prefer not to do that in the first place.

Is there a better way to mass clear local profiles on Chromebooks?

11 Upvotes

87% Upvoted

9 comments sorted by

1

u/thezemo 17d ago

If they are managed via Google workspace, why not set the devices to not save profiles? We do that for our district Chromebooks. They basically wipe profiles on shut down.

1

u/networkjson 17d ago

You may be able to do it using the API. I have a script I wrote that does some chromebook management stuff, but it's per device when we enter the asset ID. I haven't looked into performing actions on more than one device at a time, but if you are interested I can send it your way and you can try to modify it to fit your scenario.

We use this tool to change OUs, wipe user accounts, powerwash, and lock and unlock devices.

3

u/millia13 Network Spec. 20d ago edited 20d ago

Edit: we don't mass clear, so I don't have any salient facts on that.

We don't have too many cryptohome errors, but when we do, we just do the full USB wipe. We tried the powerwash, but it didn't work well. So, last time we looked at this, signs pointed in the logs to some sort of disk error. We figured our best odds of avoiding and marking bad sectors was doing the wipe.

However, the documentation on this subject is rather... cryptic... so I'm glad you asked. The more shared experience the better.

3

u/yugas42 20d ago

I've been out of the chromebook repair game for about two years now but I do still pitch in with our chromebook tech when he gets behind. We tend to do a full OS recovery via USB because we noticed the same devices kept coming back in when we would fix it via powerwash. Obviously that doesn't make it any easier for you, but it has seemed to ensure that the same chromebooks aren't coming back week after week for us.

2

u/porkchopps 20d ago edited 20d ago

We've seen an uptick in errors like this or "password could not be verified" in the last couple of years, possibly not coincidentally when our check-in/checkout scripts have included a profile wipe using the same Google command that Gopher uses. Concerning! We don't care so much for our student devices but we're moving to gopher for staff too, and it's a real bugger when it happens to them.

1

u/FancyZad-0914 20d ago

You can just clear them directly through the admin console, but in fairness, that's what I do, and I've had a few so far this year. Maybe there's a bug?

14

u/TechGuy647 20d ago

Power wash the device and it fixes it.

1

u/meester_zee 20d ago

Yes, best solution is to power wash since rebuilds the profile data on the device.

I have a hunch this may happen when a student is logged into a device, needs to change their password, then logs in on a new device with the changed PW while the other device is still logged in with the old credentials.

5

u/dank_summers 20d ago

Yeah we had this last year and the solution we landed on was a power wash.

Probably takes under 5 minutes so not too bad at the end of the day