Do not try to enroll past OOBE/enrollment.

chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 131 matching lines @@
       // Use the best mechanism, which may include attestation if available.
       config.auth_mechanism = EnrollmentConfig::AUTH_MECHANISM_BEST_AVAILABLE;
       break;
 
     case ZeroTouchEnrollmentMode::FORCED:
       // Only use attestation to authenticate since zero-touch is forced.
       config.auth_mechanism = EnrollmentConfig::AUTH_MECHANISM_ATTESTATION;
       break;
   }
 
+  // If OOBE is done and we are not enrolled, make sure we only try interactive
+  // enrollment.
   const bool oobe_complete = local_state_->GetBoolean(prefs::kOobeComplete);
+  if (oobe_complete &&
+      config.auth_mechanism == EnrollmentConfig::AUTH_MECHANISM_BEST_AVAILABLE)
+    config.auth_mechanism = EnrollmentConfig::AUTH_MECHANISM_INTERACTIVE;

[xiyuan, 2016/09/16 07:49:13]

nit: wrap with {} since the condition takes more than one line.

+  // If OOBE is done and we are enrolled, check for need to recover enrollment.
   if (oobe_complete && install_attributes_->IsEnterpriseDevice()) {
     // Regardless what mode is applicable, the enrollment domain is fixed.
     config.management_domain = install_attributes_->GetDomain();
 
     // Enrollment has completed previously and installation-time attributes
     // are in place. Enrollment recovery is required when the server
     // registration gets lost.
     if (local_state_->GetBoolean(prefs::kEnrollmentRecoveryRequired)) {
       LOG(WARNING) << "Enrollment recovery required according to pref.";
       if (DeviceCloudPolicyManagerChromeOS::GetMachineID().empty())
@@ skipping 152 matching lines @@
   if (success && (success = att_signed_data.ParseFromString(signed_data))) {
     em_signed_data.set_data(att_signed_data.data());
     em_signed_data.set_signature(att_signed_data.signature());
     em_signed_data.set_extra_data_bytes(att_signed_data.data().size() -
                                         data.size());
   }
   callback.Run(success, em_signed_data);
 }
 
 }  // namespace policy