Locked out of Google Apps

[ticker]

I have done some thing really stupid. when using the google apps directory sync tool i didn't excluded the admin account and its now disabled. Anyone else done this and been able to re-enable the account.

[Chriss31]

Hi there,

I did exactly the same thing yesterday. I went to this address:

Contact Us - Google Apps Help

and explained what had happened. I got an email less than an hour later from someone saying they'd reactivated the account. EXCELLENT customer service I must say. What a relief!

Chriss

[ticker]

Cheers, contacted them also found a forum and it looks like i am not the only one that has done this.

Hi there,

I did exactly the same thing yesterday. I went to this address:

Contact Us - Google Apps Help

and explained what had happened. I got an email less than an hour later from someone saying they'd reactivated the account. EXCELLENT customer service I must say. What a relief!

Chriss

[FN-GM]

Off topic but let me know how you get on with the sync and stuff please :-)

[Chriss31]

You're not even close to being the only one. All forum entries I found suggested it would take weeks to resolve, so I was very pleasantly surprised when it was fixed an hour later.

[FN-GM]

If you have google apps for education, you can ring them.

[ticker]

The sync went well just takes a bit of time to work through all the settings etc, when i ran the sync it all went well expect for what happend above. so just dont make that mistake.

Off topic but let me know how you get on with the sync and stuff please :-)

[CyberNerd]

haha. I did exactly the same thing.
5 min on phone and they fixed it.

REMEMBER to exclude certain accounts from sync !

[Chriss31]

Has anyone managed to successfully export user account passwords from AD? It's the one thing that's not working correctly at the moment for us.

[InterwebsGuy]

Has anyone managed to successfully export user account passwords from AD? It's the one thing that's not working correctly at the moment for us.

The only way this can be done if I remember rightly, is if you have the option ticked in AD to store unhashed passwords.
Some form of SSO using Shib or CAS would be a better solution but is a nightmare to setup.

[Oops_my_bad]

Gosh, I smiled when I saw this topic - have foolishly managed to do this several times :/

Has anyone managed to successfully export user account passwords from AD? It's the one thing that's not working correctly at the moment for us.

All you need is here:

sha1hexfltr - Active Directory sha1 hex password filter - Google Project Hosting

This is the most secure way of doing it. Only drawback is you'll need to get your users to change their passwords for AD to capture and hash their passwords following install on your DC(s). You then sync this hash using Google/Postini directory sync, it's usually stored in the "division" attribute of the user object.

Any probs post back.

[Chriss31]

Gosh, I smiled when I saw this topic - have foolishly managed to do this several times :/



All you need is here:

sha1hexfltr - Active Directory sha1 hex password filter - Google Project Hosting

This is the most secure way of doing it. Only drawback is you'll need to get your users to change their passwords for AD to capture and hash their passwords following install on your DC(s). You then sync this hash using Google/Postini directory sync, it's usually stored in the "division" attribute of the user object.

Any probs post back.

I had looked at this as an option, but I think trying to get 1200 students to change their password isn't likely going to end well. Is there a specific technical question as to why Google can't sync passwords at present?

[Oops_my_bad]

I had looked at this as an option, but I think trying to get 1200 students to change their password isn't likely going to end well. Is there a specific technical question as to why Google can't sync passwords at present?

I you have a password policy you could have everyones password changed naturally within 2-3 months (ours is 90 days force change).

I suppose the only other way would be true LDAP auth, but then you have to start punching holes in your firewall

[InterwebsGuy]

If you go down the force change password option, or provision an AD password to Google Apps keep in mind they seem to be enforcing the 8 character password minimum now.

I know for kids - and some staff too - this isn't going to be pretty as they seem in my experience quite incapable of remembering long, stronger passwords.

As I suggested earlier, some form of SSO is the best bet. Either using something like Shibboleth, CAS or if you run Moodle, through the Moodle Rooms Google Apps auth plugin. The problem with this form of authentication, as you can just set any password for the Google Apps Account, is if you users wish to have their email or calenders on a phone, or use Outlook to manage them.. this is when you need to start managing those users Google Apps passwords individually!

[Chriss31]

If you go down the force change password option, or provision an AD password to Google Apps keep in mind they seem to be enforcing the 8 character password minimum now.

I know for kids - and some staff too - this isn't going to be pretty as they seem in my experience quite incapable of remembering long, stronger passwords.

As I suggested earlier, some form of SSO is the best bet. Either using something like Shibboleth, CAS or if you run Moodle, through the Moodle Rooms Google Apps auth plugin. The problem with this form of authentication, as you can just set any password for the Google Apps Account, is if you users wish to have their email or calenders on a phone, or use Outlook to manage them.. this is when you need to start managing those users Google Apps passwords individually!

I think I'd be quite happy to investigate implementing some form of SSO setup, however I can't help but feel this would be simply bypassing a step that may end up being quite necessary. (i.e. the ability to import user passwords from AD).