Report logged in users on enterprise managed devices.

BUG=308664

Review URL: https://codereview.chromium.org/26770002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@231716 0039d316-1c4b-4281-b951-d872f2087c98

16 files changed, 249 insertions, 30 deletions

diff --git a/chrome/app/policy/policy_templates.json b/chrome/app/policy/policy_templates.json
index ff97e15..9973463 100644
--- a/chrome/app/policy/policy_templates.json
+++ b/chrome/app/policy/policy_templates.json
@@ -118,7 +118,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 247
+#   For your editing convenience: highest ID currently used: 248
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -3493,6 +3493,22 @@
       If the policy is not set, or set to false, the interface list will not be reported.''',
     },
     {
+      'name': 'ReportDeviceUsers',
+      'type': 'main',
+      'schema': { 'type': 'boolean' },
+      'supported_on': ['chrome_os:32-'],
+      'device_only': True,
+      'features': {
+        'dynamic_refresh': True,
+      },
+      'example_value': False,
+      'id': 248,
+      'caption': '''Report device users''',
+      'desc': '''Report list of device users that have recently logged in.
+
+      If the policy is not set, or set to false, the users will not be reported.''',
+    },
+    {
       'name': 'DeviceUserWhitelist',
       'type': 'list',
       'schema': {
diff --git a/chrome/browser/chromeos/login/mock_user_manager.cc b/chrome/browser/chromeos/login/mock_user_manager.cc
index 59bb273..9d0b674 100644
--- a/chrome/browser/chromeos/login/mock_user_manager.cc
+++ b/chrome/browser/chromeos/login/mock_user_manager.cc
@@ -9,12 +9,11 @@
 namespace chromeos {
 
 MockUserManager::MockUserManager()
-    : user_(NULL),
-      user_flow_(new DefaultUserFlow()),
+    : user_flow_(new DefaultUserFlow()),
       supervised_user_manager_(new FakeSupervisedUserManager()) {}
 
 MockUserManager::~MockUserManager() {
-  delete user_;
+  ClearUserList();
 }
 
 const UserList& MockUserManager::GetUsers() const {
@@ -22,11 +21,11 @@ const UserList& MockUserManager::GetUsers() const {
 }
 
 const User* MockUserManager::GetLoggedInUser() const {
-  return user_;
+  return user_list_.empty() ? NULL : user_list_.front();
 }
 
 User* MockUserManager::GetLoggedInUser() {
-  return user_;
+  return user_list_.empty() ? NULL : user_list_.front();
 }
 
 UserList MockUserManager::GetUnlockUsers() const {
@@ -34,23 +33,23 @@ UserList MockUserManager::GetUnlockUsers() const {
 }
 
 const std::string& MockUserManager::GetOwnerEmail() {
-  return user_->email();
+  return GetLoggedInUser()->email();
 }
 
 const User* MockUserManager::GetActiveUser() const {
-  return user_;
+  return GetLoggedInUser();
 }
 
 User* MockUserManager::GetActiveUser() {
-  return user_;
+  return GetLoggedInUser();
 }
 
 const User* MockUserManager::GetPrimaryUser() const {
-  return user_;
+  return GetLoggedInUser();
 }
 
 User* MockUserManager::GetUserByProfile(Profile* profile) const {
-  return user_;
+  return user_list_.empty() ? NULL : user_list_.front();
 }
 
 UserImageManager* MockUserManager::GetUserImageManager() {
@@ -63,10 +62,8 @@ SupervisedUserManager* MockUserManager::GetSupervisedUserManager() {
 
 // Creates a new User instance.
 void MockUserManager::SetActiveUser(const std::string& email) {
-  delete user_;
-  user_ = User::CreateRegularUser(email);
-  user_list_.clear();
-  user_list_.push_back(user_);
+  ClearUserList();
+  AddUser(email);
 }
 
 UserFlow* MockUserManager::GetCurrentUserFlow() const {
@@ -78,11 +75,21 @@ UserFlow* MockUserManager::GetUserFlow(const std::string&) const {
 }
 
 User* MockUserManager::CreatePublicAccountUser(const std::string& email) {
-  delete user_;
-  user_ = User::CreatePublicAccountUser(email);
+  ClearUserList();
+  user_list_.push_back(User::CreatePublicAccountUser(email));
+  return user_list_.back();
+}
+
+void MockUserManager::AddUser(const std::string& email) {
+  user_list_.push_back(User::CreateRegularUser(email));
+}
+
+void MockUserManager::ClearUserList() {
+  // Can't use STLDeleteElements because of the protected destructor of User.
+  UserList::iterator user;
+  for (user = user_list_.begin(); user != user_list_.end(); ++user)
+    delete *user;
   user_list_.clear();
-  user_list_.push_back(user_);
-  return user_;
 }
 
 void MockUserManager::RespectLocalePreference(Profile* profile,
diff --git a/chrome/browser/chromeos/login/mock_user_manager.h b/chrome/browser/chromeos/login/mock_user_manager.h
index eb3710c..c003769 100644
--- a/chrome/browser/chromeos/login/mock_user_manager.h
+++ b/chrome/browser/chromeos/login/mock_user_manager.h
@@ -103,14 +103,22 @@ class MockUserManager : public UserManager {
   virtual void RespectLocalePreference(Profile* profile, const User* user) const
       OVERRIDE;
 
-  // Sets a new User instance.
+  // Sets a new User instance. Users previously created by this MockUserManager
+  // become invalid.
   void SetActiveUser(const std::string& email);
 
   // Creates a new public session user. Users previously created by this
   // MockUserManager become invalid.
   User* CreatePublicAccountUser(const std::string& email);
 
-  User* user_;
+  // Adds a new User instance to the back of the user list. Users previously
+  // created by this MockUserManager remain valid.
+  void AddUser(const std::string& email);
+
+  // Clears the user list and the active user. Users previously created by this
+  // MockUserManager become invalid.
+  void ClearUserList();
+
   scoped_ptr<UserFlow> user_flow_;
   scoped_ptr<MockUserImageManager> user_image_manager_;
   scoped_ptr<FakeSupervisedUserManager> supervised_user_manager_;
diff --git a/chrome/browser/chromeos/policy/device_policy_decoder_chromeos.cc b/chrome/browser/chromeos/policy/device_policy_decoder_chromeos.cc
index 399b3d6..68ebdd5 100644
--- a/chrome/browser/chromeos/policy/device_policy_decoder_chromeos.cc
+++ b/chrome/browser/chromeos/policy/device_policy_decoder_chromeos.cc
@@ -376,6 +376,13 @@ void DecodeReportingPolicies(const em::ChromeDeviceSettingsProto& policy,
                         container.report_network_interfaces()),
                     NULL);
     }
+    if (container.has_report_users()) {
+      policies->Set(key::kReportDeviceUsers,
+                    POLICY_LEVEL_MANDATORY,
+                    POLICY_SCOPE_MACHINE,
+                    Value::CreateBooleanValue(container.report_users()),
+                    NULL);
+    }
   }
 }
 
diff --git a/chrome/browser/chromeos/policy/device_status_collector.cc b/chrome/browser/chromeos/policy/device_status_collector.cc
index c77d3cf..72273ba 100644
--- a/chrome/browser/chromeos/policy/device_status_collector.cc
+++ b/chrome/browser/chromeos/policy/device_status_collector.cc
@@ -15,7 +15,12 @@
 #include "base/prefs/pref_service.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/values.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/login/user.h"
+#include "chrome/browser/chromeos/login/user_manager.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
+#include "chrome/browser/policy/browser_policy_connector.h"
+#include "chrome/browser/policy/cloud/cloud_policy_constants.h"
 #include "chrome/browser/policy/proto/cloud/device_management_backend.pb.h"
 #include "chrome/browser/prefs/scoped_user_pref_update.h"
 #include "chrome/common/chrome_version_info.h"
@@ -67,6 +72,9 @@ int64 TimestampToDayKey(Time timestamp) {
   return (Time::FromUTCExploded(exploded) - Time::UnixEpoch()).InMilliseconds();
 }
 
+// Maximum number of users to report.
+const int kMaxUserCount = 5;
+
 }  // namespace
 
 namespace policy {
@@ -130,6 +138,7 @@ DeviceStatusCollector::DeviceStatusCollector(
       report_boot_mode_(false),
       report_location_(false),
       report_network_interfaces_(false),
+      report_users_(false),
       context_(new Context()) {
   if (location_update_requester) {
     location_update_requester_ = *location_update_requester;
@@ -158,6 +167,8 @@ DeviceStatusCollector::DeviceStatusCollector(
       chromeos::kReportDeviceLocation, callback);
   network_interfaces_subscription_ = cros_settings_->AddSettingsObserver(
       chromeos::kReportDeviceNetworkInterfaces, callback);
+  users_subscription_ = cros_settings_->AddSettingsObserver(
+      chromeos::kReportDeviceUsers, callback);
 
   // The last known location is persisted in local state. This makes location
   // information available immediately upon startup and avoids the need to
@@ -230,6 +241,8 @@ void DeviceStatusCollector::UpdateReportingSettings() {
       chromeos::kReportDeviceLocation, &report_location_);
   cros_settings_->GetBoolean(
       chromeos::kReportDeviceNetworkInterfaces, &report_network_interfaces_);
+  cros_settings_->GetBoolean(
+      chromeos::kReportDeviceUsers, &report_users_);
 
   if (report_location_) {
     ScheduleGeolocationUpdateRequest();
@@ -448,6 +461,32 @@ void DeviceStatusCollector::GetNetworkInterfaces(
   }
 }
 
+void DeviceStatusCollector::GetUsers(em::DeviceStatusReportRequest* request) {
+  BrowserPolicyConnector* connector =
+      g_browser_process->browser_policy_connector();
+  bool found_managed_user = false;
+  const chromeos::UserList& users = chromeos::UserManager::Get()->GetUsers();
+  chromeos::UserList::const_iterator user;
+  for (user = users.begin(); user != users.end(); ++user) {
+    em::DeviceUser* device_user = request->add_user();
+    const std::string& email = (*user)->email();
+    if (connector->GetUserAffiliation(email) == USER_AFFILIATION_MANAGED) {
+      device_user->set_type(em::DeviceUser::USER_TYPE_MANAGED);
+      device_user->set_email(email);
+      found_managed_user = true;
+    } else {
+      device_user->set_type(em::DeviceUser::USER_TYPE_UNMANAGED);
+      // Do not report the email address of unmanaged users.
+    }
+
+    // Add only kMaxUserCount entries, unless no managed users are found in the
+    // first kMaxUserCount users. In that case, continue until at least one
+    // managed user is found.
+    if (request->user_size() >= kMaxUserCount && found_managed_user)
+      break;
+  }
+}
+
 void DeviceStatusCollector::GetStatus(em::DeviceStatusReportRequest* request) {
   // TODO(mnissler): Remove once the old cloud policy stack is retired. The old
   // stack doesn't support reporting successful submissions back to here, so
@@ -473,6 +512,9 @@ bool DeviceStatusCollector::GetDeviceStatus(
   if (report_network_interfaces_)
     GetNetworkInterfaces(status);
 
+  if (report_users_)
+    GetUsers(status);
+
   return true;
 }
 
diff --git a/chrome/browser/chromeos/policy/device_status_collector.h b/chrome/browser/chromeos/policy/device_status_collector.h
index 95c24b0..6ee8df1 100644
--- a/chrome/browser/chromeos/policy/device_status_collector.h
+++ b/chrome/browser/chromeos/policy/device_status_collector.h
@@ -147,6 +147,8 @@ class DeviceStatusCollector : public CloudPolicyClient::StatusProvider {
       enterprise_management::DeviceStatusReportRequest* request);
   void GetNetworkInterfaces(
       enterprise_management::DeviceStatusReportRequest* request);
+  void GetUsers(
+      enterprise_management::DeviceStatusReportRequest* request);
 
   // Update the cached values of the reporting settings.
   void UpdateReportingSettings();
@@ -201,6 +203,7 @@ class DeviceStatusCollector : public CloudPolicyClient::StatusProvider {
   bool report_boot_mode_;
   bool report_location_;
   bool report_network_interfaces_;
+  bool report_users_;
 
   scoped_refptr<Context> context_;
 
@@ -214,6 +217,8 @@ class DeviceStatusCollector : public CloudPolicyClient::StatusProvider {
       location_subscription_;
   scoped_ptr<chromeos::CrosSettings::ObserverSubscription>
       network_interfaces_subscription_;
+  scoped_ptr<chromeos::CrosSettings::ObserverSubscription>
+      users_subscription_;
 
   DISALLOW_COPY_AND_ASSIGN(DeviceStatusCollector);
 };
diff --git a/chrome/browser/chromeos/policy/device_status_collector_browsertest.cc b/chrome/browser/chromeos/policy/device_status_collector_browsertest.cc
index 79ea72c..8c47dff 100644
--- a/chrome/browser/chromeos/policy/device_status_collector_browsertest.cc
+++ b/chrome/browser/chromeos/policy/device_status_collector_browsertest.cc
@@ -12,9 +12,13 @@
 #include "base/prefs/testing_pref_service.h"
 #include "base/run_loop.h"
 #include "base/threading/sequenced_worker_pool.h"
+#include "chrome/browser/chromeos/login/mock_user_manager.h"
+#include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/stub_enterprise_install_attributes.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/chromeos/settings/device_settings_service.h"
 #include "chrome/browser/chromeos/settings/stub_cros_settings_provider.h"
+#include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/browser/policy/proto/cloud/device_management_backend.pb.h"
 #include "chrome/common/pref_names.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
@@ -147,7 +151,9 @@ class DeviceStatusCollectorTest : public testing::Test {
     : message_loop_(base::MessageLoop::TYPE_UI),
       ui_thread_(content::BrowserThread::UI, &message_loop_),
       file_thread_(content::BrowserThread::FILE, &message_loop_),
-      io_thread_(content::BrowserThread::IO, &message_loop_) {
+      io_thread_(content::BrowserThread::IO, &message_loop_),
+      user_manager_(new chromeos::MockUserManager()),
+      user_manager_enabler_(user_manager_) {
     // Run this test with a well-known timezone so that Time::LocalMidnight()
     // returns the same values on all machines.
     scoped_ptr<base::Environment> env(base::Environment::Create());
@@ -167,6 +173,13 @@ class DeviceStatusCollectorTest : public testing::Test {
         cros_settings_->RemoveSettingsProvider(device_settings_provider_));
     cros_settings_->AddSettingsProvider(&stub_settings_provider_);
 
+    // Set up fake install attributes.
+    StubEnterpriseInstallAttributes* attributes =
+        new StubEnterpriseInstallAttributes();
+    attributes->SetDomain("managed.com");
+    attributes->SetRegistrationUser("user@managed.com");
+    BrowserPolicyConnector::SetInstallAttributesForTesting(attributes);
+
     RestartStatusCollector();
   }
 
@@ -252,6 +265,8 @@ class DeviceStatusCollectorTest : public testing::Test {
   chromeos::CrosSettings* cros_settings_;
   chromeos::CrosSettingsProvider* device_settings_provider_;
   chromeos::StubCrosSettingsProvider stub_settings_provider_;
+  chromeos::MockUserManager* user_manager_;
+  chromeos::ScopedUserManagerEnabler user_manager_enabler_;
   em::DeviceStatusReportRequest status_;
   scoped_ptr<TestingDeviceStatusCollector> status_collector_;
 };
@@ -586,6 +601,59 @@ TEST_F(DeviceStatusCollectorTest, Location) {
   CheckThatALocationErrorIsReported();
 }
 
+TEST_F(DeviceStatusCollectorTest, ReportUsers) {
+  user_manager_->AddUser("user0@managed.com");
+  user_manager_->AddUser("user1@managed.com");
+  user_manager_->AddUser("user2@managed.com");
+  user_manager_->AddUser("user3@unmanaged.com");
+  user_manager_->AddUser("user4@managed.com");
+  user_manager_->AddUser("user5@managed.com");
+
+  // Verify that users are not reported by default.
+  GetStatus();
+  EXPECT_EQ(0, status_.user_size());
+
+  // Verify that users are reported after enabling the setting.
+  cros_settings_->SetBoolean(chromeos::kReportDeviceUsers, true);
+  GetStatus();
+  EXPECT_EQ(5, status_.user_size());
+  EXPECT_EQ(em::DeviceUser::USER_TYPE_MANAGED, status_.user(0).type());
+  EXPECT_EQ("user0@managed.com", status_.user(0).email());
+  EXPECT_EQ(em::DeviceUser::USER_TYPE_MANAGED, status_.user(1).type());
+  EXPECT_EQ("user1@managed.com", status_.user(1).email());
+  EXPECT_EQ(em::DeviceUser::USER_TYPE_MANAGED, status_.user(2).type());
+  EXPECT_EQ("user2@managed.com", status_.user(2).email());
+  EXPECT_EQ(em::DeviceUser::USER_TYPE_UNMANAGED, status_.user(3).type());
+  EXPECT_FALSE(status_.user(3).has_email());
+  EXPECT_EQ(em::DeviceUser::USER_TYPE_MANAGED, status_.user(4).type());
+  EXPECT_EQ("user4@managed.com", status_.user(4).email());
+
+  // Verify that users are no longer reported if setting is disabled.
+  cros_settings_->SetBoolean(chromeos::kReportDeviceUsers, false);
+  GetStatus();
+  EXPECT_EQ(0, status_.user_size());
+}
+
+TEST_F(DeviceStatusCollectorTest, ReportManagedUser) {
+  // Verify that at least one managed user is reported regardless of list size.
+  user_manager_->AddUser("user0@unmanaged.com");
+  user_manager_->AddUser("user1@unmanaged.com");
+  user_manager_->AddUser("user2@unmanaged.com");
+  user_manager_->AddUser("user3@unmanaged.com");
+  user_manager_->AddUser("user4@unmanaged.com");
+  user_manager_->AddUser("user5@unmanaged.com");
+  user_manager_->AddUser("user6@managed.com");
+  user_manager_->AddUser("user7@managed.com");
+
+  cros_settings_->SetBoolean(chromeos::kReportDeviceUsers, true);
+  GetStatus();
+  EXPECT_EQ(7, status_.user_size());
+  for (int i = 0; i < 6; ++i)
+    EXPECT_EQ(em::DeviceUser::USER_TYPE_UNMANAGED, status_.user(i).type());
+  EXPECT_EQ(em::DeviceUser::USER_TYPE_MANAGED, status_.user(6).type());
+  EXPECT_EQ("user6@managed.com", status_.user(6).email());
+}
+
 // Fake device state.
 struct FakeDeviceData {
   const char* device_path;
diff --git a/chrome/browser/chromeos/settings/device_settings_provider.cc b/chrome/browser/chromeos/settings/device_settings_provider.cc
index 7c1d3b8..863a1dc 100644
--- a/chrome/browser/chromeos/settings/device_settings_provider.cc
+++ b/chrome/browser/chromeos/settings/device_settings_provider.cc
@@ -69,6 +69,7 @@ const char* kKnownSettings[] = {
   kReportDeviceBootMode,
   kReportDeviceLocation,
   kReportDeviceNetworkInterfaces,
+  kReportDeviceUsers,
   kReportDeviceVersionInfo,
   kScreenSaverExtensionId,
   kScreenSaverTimeout,
@@ -403,6 +404,7 @@ void DeviceSettingsProvider::SetInPolicy() {
     //   kReportDeviceLocation
     //   kReportDeviceVersionInfo
     //   kReportDeviceNetworkInterfaces
+    //   kReportDeviceUsers
     //   kScreenSaverExtensionId
     //   kScreenSaverTimeout
     //   kStartUpUrls
@@ -676,6 +678,11 @@ void DeviceSettingsProvider::DecodeReportingPolicies(
           kReportDeviceNetworkInterfaces,
           reporting_policy.report_network_interfaces());
     }
+    if (reporting_policy.has_report_users()) {
+      new_values_cache->SetBoolean(
+          kReportDeviceUsers,
+          reporting_policy.report_users());
+    }
   }
 }
 
diff --git a/chrome/browser/policy/browser_policy_connector.cc b/chrome/browser/policy/browser_policy_connector.cc
index 832dc33..a405c31 100644
--- a/chrome/browser/policy/browser_policy_connector.cc
+++ b/chrome/browser/policy/browser_policy_connector.cc
@@ -98,6 +98,11 @@ const int64 kServiceInitializationStartupDelay = 5000;
 const char kDefaultDeviceManagementServerUrl[] =
     "https://m.google.com/devicemanagement/data/api";
 
+#if defined(OS_CHROMEOS)
+// Install attributes for tests.
+EnterpriseInstallAttributes* g_testing_install_attributes = NULL;
+#endif  // defined(OS_CHROMEOS)
+
 // Used in BrowserPolicyConnector::SetPolicyProviderForTesting.
 ConfigurationPolicyProvider* g_testing_provider = NULL;
 
@@ -210,6 +215,9 @@ BrowserPolicyConnector::BrowserPolicyConnector()
   platform_provider_.reset(CreatePlatformProvider());
 
 #if defined(OS_CHROMEOS)
+  if (g_testing_install_attributes)
+    install_attributes_.reset(g_testing_install_attributes);
+
   // SystemSaltGetter or DBusThreadManager may be uninitialized on unit tests.
 
   // TODO(satorux): Remove SystemSaltGetter::IsInitialized() when it's ready
@@ -218,8 +226,10 @@ BrowserPolicyConnector::BrowserPolicyConnector()
       chromeos::DBusThreadManager::IsInitialized()) {
     chromeos::CryptohomeClient* cryptohome_client =
         chromeos::DBusThreadManager::Get()->GetCryptohomeClient();
-    install_attributes_.reset(
-        new EnterpriseInstallAttributes(cryptohome_client));
+    if (!g_testing_install_attributes) {
+      install_attributes_.reset(
+          new EnterpriseInstallAttributes(cryptohome_client));
+    }
     base::FilePath install_attrs_file;
     CHECK(PathService::Get(chromeos::FILE_INSTALL_ATTRIBUTES,
                            &install_attrs_file));
@@ -453,6 +463,12 @@ void BrowserPolicyConnector::SetUserPolicyDelegate(
     ConfigurationPolicyProvider* user_policy_provider) {
   global_user_cloud_policy_provider_.SetDelegate(user_policy_provider);
 }
+
+void BrowserPolicyConnector::SetInstallAttributesForTesting(
+    EnterpriseInstallAttributes* attributes) {
+  DCHECK(!g_testing_install_attributes);
+  g_testing_install_attributes = attributes;
+}
 #endif
 
 // static
diff --git a/chrome/browser/policy/browser_policy_connector.h b/chrome/browser/policy/browser_policy_connector.h
index f6cb3e3..733b516 100644
--- a/chrome/browser/policy/browser_policy_connector.h
+++ b/chrome/browser/policy/browser_policy_connector.h
@@ -130,6 +130,11 @@ class BrowserPolicyConnector {
   // previously set delegate is removed. Passing NULL removes the current
   // delegate, if there is one.
   void SetUserPolicyDelegate(ConfigurationPolicyProvider* user_policy_provider);
+
+  // Sets the install attributes for testing. Must be called before the browser
+  // is created. Takes ownership of |attributes|.
+  static void SetInstallAttributesForTesting(
+      EnterpriseInstallAttributes* attributes);
 #endif
 
   // Sets a |provider| that will be included in PolicyServices returned by
diff --git a/chrome/browser/policy/proto/chromeos/chrome_device_policy.proto b/chrome/browser/policy/proto/chromeos/chrome_device_policy.proto
index 0364e0f..911866b 100644
--- a/chrome/browser/policy/proto/chromeos/chrome_device_policy.proto
+++ b/chrome/browser/policy/proto/chromeos/chrome_device_policy.proto
@@ -96,6 +96,7 @@ message DeviceReportingProto {
   optional bool report_boot_mode = 3;
   optional bool report_location = 4;
   optional bool report_network_interfaces = 5;
+  optional bool report_users = 6;
 }
 
 message EphemeralUsersEnabledProto {
diff --git a/chrome/browser/policy/proto/cloud/device_management_backend.proto b/chrome/browser/policy/proto/cloud/device_management_backend.proto
index f4645f7..1b0bb35 100644
--- a/chrome/browser/policy/proto/cloud/device_management_backend.proto
+++ b/chrome/browser/policy/proto/cloud/device_management_backend.proto
@@ -408,6 +408,24 @@ message NetworkInterface {
   optional string imei = 4;
 }
 
+// Details about a device user.
+message DeviceUser {
+  // Types of device users which can be reported.
+  enum UserType {
+    // A user managed by the same domain as the device.
+    USER_TYPE_MANAGED = 0;
+
+    // A user not managed by the same domain as the device.
+    USER_TYPE_UNMANAGED = 1;
+  }
+
+  // The type of the user.
+  required UserType type = 1;
+
+  // Email address of the user. Present only if the user type is managed.
+  optional string email = 2;
+}
+
 // Report device level status.
 message DeviceStatusReportRequest {
   // The OS version reported by the device is a platform version
@@ -435,6 +453,9 @@ message DeviceStatusReportRequest {
 
   // List of network interfaces.
   repeated NetworkInterface network_interface = 8;
+
+  // List of recent device users, in descending order by last login time.
+  repeated DeviceUser user = 9;
 }
 
 // Report session (a user on one device) level status.
diff --git a/chrome/test/data/policy/policy_test_cases.json b/chrome/test/data/policy/policy_test_cases.json
index 78458de..b46e9dd 100644
--- a/chrome/test/data/policy/policy_test_cases.json
+++ b/chrome/test/data/policy/policy_test_cases.json
@@ -1978,6 +1978,9 @@
   "ReportDeviceNetworkInterfaces": {
   },
 
+  "ReportDeviceUsers": {
+  },
+
   "DeviceAllowNewUsers": {
   },
 
diff --git a/chromeos/settings/cros_settings_names.cc b/chromeos/settings/cros_settings_names.cc
index a82a254..fbc30a3 100644
--- a/chromeos/settings/cros_settings_names.cc
+++ b/chromeos/settings/cros_settings_names.cc
@@ -85,6 +85,10 @@ const char kReportDeviceLocation[] = "cros.device_status.report_location";
 const char kReportDeviceNetworkInterfaces[] =
     "cros.device_status.report_network_interfaces";
 
+// Determines whether the device reports recently logged in users in device
+// status reports to the device management server.
+const char kReportDeviceUsers[] = "cros.device_status.report_users";
+
 // A list of dictionaries, each detailing one extension to install as part of
 // the AppPack and including the following fields:
 // "extension-id": ID of the extension to install
diff --git a/chromeos/settings/cros_settings_names.h b/chromeos/settings/cros_settings_names.h
index b0971dd..ffaf6f4 100644
--- a/chromeos/settings/cros_settings_names.h
+++ b/chromeos/settings/cros_settings_names.h
@@ -50,6 +50,7 @@ CHROMEOS_EXPORT extern const char kReportDeviceActivityTimes[];
 CHROMEOS_EXPORT extern const char kReportDeviceBootMode[];
 CHROMEOS_EXPORT extern const char kReportDeviceLocation[];
 CHROMEOS_EXPORT extern const char kReportDeviceNetworkInterfaces[];
+CHROMEOS_EXPORT extern const char kReportDeviceUsers[];
 
 CHROMEOS_EXPORT extern const char kAppPack[];
 CHROMEOS_EXPORT extern const char kAppPackKeyExtensionId[];
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 1461652..57b1f59 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -21144,8 +21144,8 @@ other types of suffix sets.
       label="Enable submission of documents to Google Cloud Print"/>
   <int value="110" label="Set disk cache size in bytes"/>
   <int value="111" label="Set media disk cache size in bytes"/>
-  <int value="112" label="Enterprise web store URL"/>
-  <int value="113" label="Enterprise web store name"/>
+  <int value="112" label="Enterprise web store URL (deprecated)"/>
+  <int value="113" label="Enterprise web store name (deprecated)"/>
   <int value="114" label="Enable TLS domain-bound certificates extension"/>
   <int value="115" label="Enable reporting memory info (JS heap size) to page"/>
   <int value="116" label="Proxy settings"/>
@@ -21176,8 +21176,10 @@ other types of suffix sets.
   <int value="137" label="Load specified urls on demo login"/>
   <int value="138"
       label="Continue running background apps when Google Chrome is closed"/>
-  <int value="139" label="Disables Drive"/>
-  <int value="140" label="Disables Google Drive over Cellular connections"/>
+  <int value="139" label="Disables Drive in the Chrome OS Files app"/>
+  <int value="140"
+      label="Disables Google Drive over Cellular connections in the Chrome OS
+             Files app"/>
   <int value="141"
       label="Additional command line parameters for Google Chrome"/>
   <int value="142" label="Target Auto Update Version"/>
@@ -21234,9 +21236,10 @@ other types of suffix sets.
   <int value="183"
       label="Specify whether video activity affects power management"/>
   <int value="184"
-      label="Percentage by which to scale the idle delay in presentation mode"/>
+      label="Percentage by which to scale the idle delay in presentation mode
+             (deprecated)"/>
   <int value="185"
-      label="Allow users to redeem offers through Chrome OS Registration."/>
+      label="Allow users to redeem offers through Chrome OS Registration"/>
   <int value="186" label="Set the Terms of Service for a device-local account"/>
   <int value="187" label="Enable deleting browser and download history"/>
   <int value="188" label="Show accessibility options in system tray menu"/>
@@ -21327,6 +21330,11 @@ other types of suffix sets.
   <int value="246"
       label="Selects the strategy used to free up disk space during automatic
              clean-up"/>
+  <int value="247"
+      label="Specify whether power management delays and the session length
+             limit should only start running after initial user activity in a
+             session"/>
+  <int value="248" label="Report device users"/>
 </enum>
 
 <enum name="EnterprisePolicyInvalidations" type="int">