Use the Windows MDM API to check if the machine is being managed.

base/win/win_util.cc

Index: base/win/win_util.cc
diff --git a/base/win/win_util.cc b/base/win/win_util.cc
index a1b7f8985590dd709c89ba6cb1b579e14222e0ce..92810887bf56312eae3282f7c2c1f4e3b1f77edd 100644
--- a/base/win/win_util.cc
+++ b/base/win/win_util.cc
@@ -10,6 +10,7 @@
 #include <shobjidl.h>  // Must be before propkey.
 #include <initguid.h>
 #include <inspectable.h>
+#include <mdmregistration.h>
 #include <propkey.h>
 #include <propvarutil.h>
 #include <psapi.h>
@@ -496,6 +497,29 @@ bool IsEnrolledToDomain() {
   return g_domain_state == ENROLLED;
 }
 
+bool IsDeviceRegisteredWithMdm() {
+  using IsDeviceRegisteredWithManagementFunction =
+      decltype(&IsDeviceRegisteredWithManagement);
+
+  static IsDeviceRegisteredWithManagementFunction fn = nullptr;

[grt (UTC plus 2), 2017/02/08 21:59:55]

please initialize this in a lambda sorta like is_user32_and_gdi32_available
below so that the LoadLibrary is only attempted the first time through. as it is
now, a failure to load/resolve on the first call will attempt the load on every
subsequent call.

[Roger Tawa OOO till Jul 10th, 2017/02/09 14:55:59]

Done.  I was debating whether to do this or not, but agree the state is unlikely
to change during a run of chrome.

+  if (!fn) {
+    HMODULE mdm_dll = ::LoadLibrary(L"MDMRegistration.dll");

[Roger Tawa OOO till Jul 10th, 2017/02/09 14:55:59]

Should I call FreeLibrary() after calling through fn?  Not sure if its better to
keep this dll loaded or not.

+    fn = reinterpret_cast<IsDeviceRegisteredWithManagementFunction>(
+        ::GetProcAddress(mdm_dll, "IsDeviceRegisteredWithManagement"));
+    if (!fn) {

[grt (UTC plus 2), 2017/02/08 21:59:55]

nit: omit braces for one-liners like this

[Roger Tawa OOO till Jul 10th, 2017/02/09 14:55:59]

Done.

+      return false;
+    }
+  }
+
+  BOOL is_managed = false;
+  HRESULT hr = fn(&is_managed, 0, nullptr);
+  return SUCCEEDED(hr) && is_managed;
+}
+
+bool IsEnterpriseUser() {

[grt (UTC plus 2), 2017/02/08 21:59:55]

this is checking machine-level rather than user account-level state, no? if this
is the case, i think "user" is a misleading term.

[Roger Tawa OOO till Jul 10th, 2017/02/09 14:55:59]

I'll wait for Georges' suggestion on the name.  However we use "user" in many
other places, both in code and comments.

[Georges Khalil, 2017/02/09 14:59:57]

I will suggest IsEnterpriseManaged, which is what is used by ChromeOS:

https://cs.chromium.org/chromium/src/chrome/browser/chromeos/policy/browser_p...

[Roger Tawa OOO till Jul 10th, 2017/02/09 16:06:43]

Done.  Note that the UMA stat is called "IsEnterpriseUser" which I can't change.

+  return IsEnrolledToDomain() || IsDeviceRegisteredWithMdm();
+}
+
 void SetDomainStateForTesting(bool state) {
   g_domain_state = state ? ENROLLED : NOT_ENROLLED;
 }