Use the Windows MDM API to check if the machine is being managed.

base/win/win_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/win/win_util.h"
 
 #include <aclapi.h>
 #include <cfgmgr32.h>
 #include <powrprof.h>
 #include <shobjidl.h>  // Must be before propkey.
 #include <initguid.h>
 #include <inspectable.h>
+#include <mdmregistration.h>
 #include <propkey.h>
 #include <propvarutil.h>
 #include <psapi.h>
 #include <roapi.h>
 #include <sddl.h>
 #include <setupapi.h>
 #include <shellscalingapi.h>
 #include <shlwapi.h>
 #include <signal.h>
 #include <stddef.h>
@@ skipping 466 matching lines @@
   if (g_domain_state == UNKNOWN) {
     ::InterlockedCompareExchange(&g_domain_state,
                                  IsOS(OS_DOMAINMEMBER) ?
                                      ENROLLED : NOT_ENROLLED,
                                  UNKNOWN);
   }
 
   return g_domain_state == ENROLLED;
 }
 
+bool IsDeviceRegisteredWithMdm() {
+  using IsDeviceRegisteredWithManagementFunction =
+      decltype(&IsDeviceRegisteredWithManagement);
+
+  static IsDeviceRegisteredWithManagementFunction fn = nullptr;

[grt (UTC plus 2), 2017/02/08 21:59:55]

please initialize this in a lambda sorta like is_user32_and_gdi32_available
below so that the LoadLibrary is only attempted the first time through. as it is
now, a failure to load/resolve on the first call will attempt the load on every
subsequent call.

[Roger Tawa OOO till Jul 10th, 2017/02/09 14:55:59]

Done.  I was debating whether to do this or not, but agree the state is unlikely
to change during a run of chrome.

+  if (!fn) {
+    HMODULE mdm_dll = ::LoadLibrary(L"MDMRegistration.dll");

[Roger Tawa OOO till Jul 10th, 2017/02/09 14:55:59]

Should I call FreeLibrary() after calling through fn?  Not sure if its better to
keep this dll loaded or not.

+    fn = reinterpret_cast<IsDeviceRegisteredWithManagementFunction>(
+        ::GetProcAddress(mdm_dll, "IsDeviceRegisteredWithManagement"));
+    if (!fn) {

[grt (UTC plus 2), 2017/02/08 21:59:55]

nit: omit braces for one-liners like this

[Roger Tawa OOO till Jul 10th, 2017/02/09 14:55:59]

Done.

+      return false;
+    }
+  }
+
+  BOOL is_managed = false;
+  HRESULT hr = fn(&is_managed, 0, nullptr);
+  return SUCCEEDED(hr) && is_managed;
+}
+
+bool IsEnterpriseUser() {

[grt (UTC plus 2), 2017/02/08 21:59:55]

this is checking machine-level rather than user account-level state, no? if this
is the case, i think "user" is a misleading term.

[Roger Tawa OOO till Jul 10th, 2017/02/09 14:55:59]

I'll wait for Georges' suggestion on the name.  However we use "user" in many
other places, both in code and comments.

[Georges Khalil, 2017/02/09 14:59:57]

I will suggest IsEnterpriseManaged, which is what is used by ChromeOS:

https://cs.chromium.org/chromium/src/chrome/browser/chromeos/policy/browser_p...

[Roger Tawa OOO till Jul 10th, 2017/02/09 16:06:43]

Done.  Note that the UMA stat is called "IsEnterpriseUser" which I can't change.

+  return IsEnrolledToDomain() || IsDeviceRegisteredWithMdm();
+}
+
 void SetDomainStateForTesting(bool state) {
   g_domain_state = state ? ENROLLED : NOT_ENROLLED;
 }
 
 bool IsUser32AndGdi32Available() {
   static auto is_user32_and_gdi32_available = []() {
     // If win32k syscalls aren't disabled, then user32 and gdi32 are available.
 
     // Can't disable win32k prior to windows 8.
     if (base::win::GetVersion() < base::win::VERSION_WIN8)
@@ skipping 93 matching lines @@
             awareness == PROCESS_PER_MONITOR_DPI_AWARE)
           per_monitor_dpi_aware = PerMonitorDpiAware::PER_MONITOR_DPI_AWARE;
       }
     }
   }
   return per_monitor_dpi_aware == PerMonitorDpiAware::PER_MONITOR_DPI_AWARE;
 }
 
 }  // namespace win
 }  // namespace base