DeviceRollbackAllowedMilestones

Depending on the board and critical vulnerability patches, Google ChromeOS milestones may include kernel key increments that are incompatible with earlier milestones. On consumer devices, these increments are applied as soon as a release with the increment is installed. In verified mode, this prevents rollback to older versions that do not have the increment. On enrolled devices, this policy controls when the increment is applied: the increment can be held back for up to 4 milestones (approximately 4 months) after the first milestone with the increment was released on the Stable channel. This allows enterprises to postpone rollback protection for this duration. Default is 4 for enrolled devices. Setting the value to 0 enforces the same behavior as in consumer devices. Setting this policy to a lower value can have a permanent effect: Once the increment is applied on the device, the device cannot rollback to milestone with lower kernel key version. This cannot be undone by setting the policy to a larger value afterwards.