New Google Chrome feature for Windows - Force users to sign in to the browser

[Arthur]

Just in case you didn't already know, there's a new feature in Chrome 64 that allows you to force users to sign into the browser on Windows PCs. It has taken Google almost five years to implement this.

 

https://support.google.com/chrome/a/answer/7572556

 

Force users to sign in to Chrome

Supported on Chrome 64 and later on Windows computers.

 

As an administrator, you can force users to sign in to a Chrome profile, with a Google Account, before they use Google Chrome on a Microsoft Windows computer. This ensures that the Chrome policies and settings that you set using the Admin console are applied on users’ computers. When a user opens Chrome on a Windows computer, they’re prompted to sign in immediately. If they sign out of Chrome, they’re redirected to the sign-in page. So, users can only use Chrome on a Windows computer when they’re signed in to their Chrome profile.

 

Before you begin

If you want to use group policy settings to control Chrome on users Windows computers, first you need to install the Chrome group policy template. Then, you can use the Group Policy Management Console to apply policies to users.

 

Apply policies to users

You can control which users can sign in to Chrome. You can also specify that certain users must sign in to Chrome before they use it.

 

After you configure policies, users must restart Chrome on their device for the settings to take effect.

 

You can use 2 policies:

 

RestrictSigninToPattern—Specifies which users can sign in to Chrome on Windows, Mac, and Linux devices. For example, you can prevent users from signing in using their Gmail account.

• Specify *@yourdomain.com to only let users with an @yourdomain.com account sign in.
  
• Specify [email protected] to only let a specific user, user-id, sign in.
  

ForceBrowserSignin—Forces users to sign in to Chrome on Windows computers.

• For Windows group policy, turn on the Enables force sign in for Google Chrome policy.
  
• For Windows registry, set ForceBrowserSignin to 0x00000001.
  

 

[fiza]

This has been a long time coming!

[mjk]

...but not file stream !

[BACA]

I have downloaded the latest templates dated 2nd Jan. Don't see this option.

[Arthur]

I have downloaded the latest templates dated 2nd Jan. Don't see this option.

It's showing up for me.

 

Computer Configuration > Google > Google Chrome > Enables force sign in for Google Chrome

[BACA]

Sorted it. Needed an older copy of the templates. See comment 149 here https://bugs.chromium.org/p/chromium/issues/detail?id=175880

[Arthur]

Sorted it. Needed an older copy of the templates. See comment 149 here https://bugs.chromium.org/p/chromium/issues/detail?id=175880

FWIW, I am using the ADMX templates from the latest 64-bit Chrome Enterprise bundle (downloaded today) and the setting is definitely there.

 

https://enterprise.google.com/intl/en_uk/chrome/chrome-browser/#download

[BACA]

The original termplates I got were from here https://support.google.com/chrome/a/answer/187202#windows. Will try your set thanks.

[Manny-Tech]

Is it possible to have users signed in without the 'your administrator requires you to sign-in' message?

[Jaan]

This works for us, however it's causing confusion, as users seem to have to click the "add user" button and add another account, even though one exists called "you".

 

Anybody having issues with this?

[tj2419]

Has Chrome updated to force this by default? We hadn't changed any settings for this or installed the new adm. Users since Monday are now being prompted to sign in every time they open a new tab.

 

When looking at the GPO you just get Disable sign in, Enable sign in or force sign in. We don't want to prevent users signing in but we also don't want to force them at this stage.

 

Thanks

[Arthur]

Users since Monday are now being prompted to sign in every time they open a new tab.

Are you seeing the sign in page pictured in the first post or the one below?

 

[tj2419]

Are you seeing the sign in page pictured in the first post or the one below?

 

 

It's the one in the image you have uploaded in this post.

[tj2419]

Are you seeing the sign in page pictured in the first post or the one below?

 

 

Hi @Arthur sorry to pester but do you know what causes that log in screen? Cheers

[Arthur]

do you know what causes that log in screen? Cheers

I think it is related to the new sign in features Google introduced in Chrome v69.

 

www.zdnet.com/article/backlash-sees-change-in-chrome-login-and-google-account-behaviour

 

Have you suppressed the first run and welcome pages in your master_preferences file and/or Chrome GPO?

[tj2419]

I think it is related to the new sign in features Google introduced in Chrome v69.

 

www.zdnet.com/article/backlash-sees-change-in-chrome-login-and-google-account-behaviour

 

Have you suppressed the first run and welcome pages in your master_preferences file and/or Chrome GPO?

 

Just tried preventing the welcome screen in chrome but the log in still appears when you make a new tab

[Arthur]

Just tried preventing the welcome screen in chrome but the log in still appears when you make a new tab

Try deploying the Chrome first run and default preference files and then log on as a new user.

 

The PowerShell commands below will do this if you want to test it on one computer.

 

$ChromePrefs = '{"browser":{ "has_seen_welcome_page":true }}'
New-Item -Path "env:SystemDrive\Users\Default\AppData\Local\Google\Chrome\User Data\Default\Preferences" -Value "$ChromePrefs" -ItemType File -Force | Out-Null
New-Item -Path "env:SystemDrive\Users\Default\AppData\Local\Google\Chrome\User Data\First Run" -ItemType File -Force | Out-Null

 

Related thread: www.edugeek.net/forums/enterprise-software/178319-google-chrome-welcome-screen.html#post1572171

[Dexterp123]

Sorry to grave dig this, but hey.

 

I'm wanting to roll out RM Buzz, we have a mix of Chromebooks and Windows machines. The key to getting Windows machines covered is in forcing users to login, but there's something that just isn't working for me.I can login, but as soon as I log out the username/profile disappears.

 

We don't want students typing in their email addresses to sign in, so I was hoping that after one sign in, it would keep a user name in the same way as a Chromebook. This way they click on their name, type in a password, and done. Does anyone have any ideas on this?

[mjk]

Question:

Suppose a site has ADFS and also uses Google SAML Single Sign on.

Can we use Windows Integrated Authentication so that when the user signs into a workstation the password is automatically passed through to ADFS and this intern logs them into the browser ?Has anyone done this?

 

Sounds like it 'might' be possible but would be interested if anyone has tried:

https://social.technet.microsoft.com/Forums/en-US/0886b8e4-3b46-48be-b00b-358e3327c548/windows-integrated-authentication-adfs-30-any-browser-windows-and-mac?forum=ADFS

[Arthur]

According to the latest Chrome ADMX templates, the "Enable force sign in for Google Chrome" policy is now deprecated.

 

I think the replacement for this might be the new Chrome managed browser feature...

 

https://blog.theserverlessschool.net/2019/04/managing-chrome-from-cloud.html

(via: https://plus.google.com/102599782535912502874/posts/3ekTW8RJVLF)

 

 

[Ditto]

Sadly I can't get to the Google+ link as I only have a non-school-domain account. Wish there was a work-around...

[fiza]

This looks way better than the GPO method.