Enrolling is what lifts the off-store restriction without joining a domain, and it is one machine-scoped token in both places Chrome looks: HKLM on Windows, a file under /etc/opt/chrome/policies/enrollment on Linux. Both scripts take --remove, and both say plainly that removing the token locally does not release the seat in the Admin console. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>