Google Drive Education Password Sync

[ITGURU]

I've installed the Google user synchronisation tool which successfully syncs AD users to Google with their email address and currently set to use a set password for all new users.

I want to change it so that like office 365 it sync AD passwords too.

I looked at the following page which says to use the password sync I have to upgrade to G Suite basic, but this appears chargeable? https://support.google.com/a/answer/2611859?hl=en

 

Is that correct that the password sync will not work with the free GCDS that i have installed?

[Arthur]

Is that correct that the password sync will not work with the free GCDS that I have installed?

I'm using both GCDS and GCPS with the free G Suite for Education.

 

I looked at the following page which says to use the password sync I have to upgrade to G Suite basic, but this appears chargeable?

That message changes depending upon which type of Google account you are currently logged in with.

 

If I log in with a G Suite for Education account I see this...

 

 

If I log in with my own "legacy" G Suite account I see this...

 

[ITGURU]

Thanks. is there definitely no way to sync existing AD passwords to Google like MS office 365 does without having to get users to change their AD password first for it to then sync?

[Arthur]

Unfortunately not.

 

https://support.google.com/a/answer/2920764?hl=en

 

In Active Directory, passwords are stored as write-only. They can't be read through any interface, such as LDAP. Therefore, conventional synchronization methods (for example, Google Cloud Directory Sync) can't access them. The only way to read passwords is to capture them when they are set or changed.

[ITGURU]

Unfortunately not.

 

https://support.google.com/a/answer/2920764?hl=en

I guess i could start with the new intake being synchronised when they set their passwords then it'll eventually work it's way through the 5 years rotation either when students change password or get the 5th year intake.

[AlanD]

Thanks. is there definitely no way to sync existing AD passwords to Google like MS office 365 does without having to get users to change their AD password first for it to then sync?

 

Only the hashes of passwords are stored in AD....so its not possible to get a copy of the original password into google without doing a password change and capturing the passwords on the fly...

 

I get them to change their password to something easy - like ABC123xyz and then change it back to their original password.

 

If its a password you set...you can run a script to do it for them....but the process of changing the password must happen.

 

No sure why google doesn't do passthrough authentication - like Azure AD connect is capable of doing with Office 365 - so once users have signed on to a PC the google authentication would be automatic.

 

Perhaps its because we still have an old version of GAPS (and GADS) but I always have a handful of users whose passwords won't sync after a changing them...until I manually intervene and set their password directly in google admin. Never understood what makes it work for 95 users and fail 5 users ...thought it might be a poor password...or mistyped...or something...but can't track down the common problem which makes it fail for these few exceptions.

[DrCheese]

I tied my Google Apps account into my ADFS server, so it doesn't matter if users have changed passwords on google or not, it just authenticates against our active directory

[LukeRowberry]

If you get azure AD you can add your gsuite into that and then do saml SSO. With us when they use google it pushes them to azure ad which is SSO so it’s just straight in without needing a password etc. From home they just use their email address and school ad password to login. No need to use google sync tools.

[mavhc]

Is Azure AD free?

 

Tip when forcing people to change their password: set a min password length of >0, otherwise about 5% of people will end up with a blank password and not even realise it