> So an unmanaged Chromebook can't be "taken over" by logging into a managed account, the policies are only active until you reboot. That's my understanding, y

> So an unmanaged Chromebook can't be "taken over" by logging into a managed account, the policies are only active until you reboot. That's my understanding, yes. You can't "infect" an unmanaged account from a managed one, as far as I know at least. > E.g., if the managed account has a policy that sets proxy settings or force-installs a particular browser extension, would those policies also be applied to the unmanaged account? I'm not 100% sure if those policies would apply, I admit I'm not familiar with the account enrolment details of ChromeOS since I work at a much lower level. However, from what I know, whenever you go to sign-in to a secondary account in the same session as your primary one, there's a big warning telling you to be careful because you're basically "entrusting" your secondary account to the primary one and to not share an account session with another account you do not trust. This I always assumed was due to reasons like (for example) ending up literally sharing account2 window with account1 session, if you bring a program running in the account2 "domain" (filesystem, etc) into the account1 UI session, the account1 can take a screenshot of it (screenshot will be saved into account1 local files) and that can leak data obviously.