newpersn Posted July 17, 2018 Posted July 17, 2018 Just been asked to create google accounts for a school that isnt setup with Google. How do i start? I've done O365 but not google before. Thanks.
BKGarry Posted July 17, 2018 Posted July 17, 2018 i Followed these instructions https://support.google.com/a/answer/2856827?hl=en Once I had our domain activated I used Google Active Directory Sync in order to synchronise all my AD users as a scheduled tasks, it also syncs our Salamander AD Sync Groups as well. Then I installed GAPS, their password sync software, on each Domain controller and then when a user changes their password, it pretty much instantly (couple of seconds) synchronises to G Suite. I have GMail disabled here, as we use Office 365 for email, and that receives all the Google Emails. I hope that helps 2
newpersn Posted July 17, 2018 Author Posted July 17, 2018 i Followed these instructions https://support.google.com/a/answer/2856827?hl=en Once I had our domain activated I used Google Active Directory Sync in order to synchronise all my AD users as a scheduled tasks, it also syncs our Salamander AD Sync Groups as well. Then I installed GAPS, their password sync software, on each Domain controller and then when a user changes their password, it pretty much instantly (couple of seconds) synchronises to G Suite. I have GMail disabled here, as we use Office 365 for email, and that receives all the Google Emails. I hope that helps That does help
BKGarry Posted July 17, 2018 Posted July 17, 2018 It was actually pretty pain free TBH. You can set it up to authenticate against ADFS, but I never went that far, as Google Classroom didn't have custom URLs to redirect straight to the ADFS login page, where most the other services did, I don't know if that has changed or not. I chose to stick with Google's own authentication, just for ease.
dhicks Posted July 17, 2018 Posted July 17, 2018 Then I installed GAPS, their password sync software, on each Domain controller and then when a user changes their password, it pretty much instantly (couple of seconds) synchronises to G Suite. We found there was some confusion about the "when a user changes their password" bit - the user needs to change their password in Windows / Active Directory for passwords to be synchronised, it does't pick up existing passwords. Over the summer might be a good point to reset user passwords to a known value that you can have teachers dish out at the start of term.
BKGarry Posted July 17, 2018 Posted July 17, 2018 We found there was some confusion about the "when a user changes their password" bit - the user needs to change their password in Windows / Active Directory for passwords to be synchronised, it does't pick up existing passwords. Over the summer might be a good point to reset user passwords to a known value that you can have teachers dish out at the start of term. GADS, the AD sync, does allow you to set a default password for G Suite users until they change their AD password. for mass password resetting, this DOS command allows you to reset all passwords of users in a specified OU DSQUERY user "OU=2011,OU=Students,OU=OU2,OU=OU1,DC=DOMAIN,DC=LOCAL" -limit 0 | DSMOD user -pwd 1
newpersn Posted July 17, 2018 Author Posted July 17, 2018 We found there was some confusion about the "when a user changes their password" bit - the user needs to change their password in Windows / Active Directory for passwords to be synchronised, it does't pick up existing passwords. Over the summer might be a good point to reset user passwords to a known value that you can have teachers dish out at the start of term. GADS, the AD sync, does allow you to set a default password for G Suite users until they change their AD password. for mass password resetting, this DOS command allows you to reset all passwords of users in a specified OU DSQUERY user "OU=2011,OU=Students,OU=OU2,OU=OU1,DC=DOMAIN,DC=LOCAL" -limit 0 | DSMOD user -pwd Could you not use "User must change password on next login?"
BKGarry Posted July 17, 2018 Posted July 17, 2018 Yeah you can for that one, that's what I would do as well. But if you actually wanted to change all the passwords to the same you can use that command :-) 1
dhicks Posted July 17, 2018 Posted July 17, 2018 Could you not use "User must change password on next login?" We're a prep school, we find the younger children can struggle with password changes (they're generally fine by year 4, though). 1
newpersn Posted July 17, 2018 Author Posted July 17, 2018 Just an thought. Do you have to install GAP's on all DC's or can i do just 1?
BKGarry Posted July 17, 2018 Posted July 17, 2018 GAPS goes on all your writing DCs. Luckily, we only have two :-) It is very lightweight.
newpersn Posted July 17, 2018 Author Posted July 17, 2018 GAPS goes on all your writing DCs. Luckily, we only have two :-) It is very lightweight. Nice. We only have 2 as well.
Garacesh Posted July 17, 2018 Posted July 17, 2018 Make sure you disable non-admin password recovery! It's in Security, Basic Settings, Enable/disable non-admin user password recovery ›› Google, in their infinite wisdom, allow you to enter an old password to access the password reset if you forget (or someone changes) the current one. Except GCDS/GADS creates accounts with all the same password. You can see the issue here, 1
BKGarry Posted July 17, 2018 Posted July 17, 2018 Good shout there @Garacesh I forgot to mention that too.
newpersn Posted July 17, 2018 Author Posted July 17, 2018 More annoying.... Cant verify our domain even know i've added the txt in to our external DNS
BKGarry Posted July 17, 2018 Posted July 17, 2018 Sometimes it takes a couple of hours for that to be detected at Google's end, something to do with replication and crawling. Try verifying again tomorrow :-) 1
ADMaster Posted July 17, 2018 Posted July 17, 2018 Make sure you disable non-admin password recovery! It's in Security, Basic Settings, Enable/disable non-admin user password recovery ›› Google, in their infinite wisdom, allow you to enter an old password to access the password reset if you forget (or someone changes) the current one. Except GCDS/GADS creates accounts with all the same password. You can see the issue here, Can I get a visual on this, I've never seen or heard of this setting before. However I do have passcore setup. Its not true SSO, but users are directed to it instead of googles change password page. I tried to say I forgot my password, entered an old one and was asked to contact my administrator. Thanks,
Garacesh Posted July 17, 2018 Posted July 17, 2018 Huh, weird. At a guess, I'd suggest it might not be available if you're using an SSO solution without any kind of writeback capability. But that's just a guess.
newpersn Posted July 19, 2018 Author Posted July 19, 2018 All verified now. Just need to reboot the DC's for GAPS... (May do one at a time and see if anyone notices....)
BKGarry Posted July 19, 2018 Posted July 19, 2018 do it, one at a time, good time to test your tolerance for 5 minutes or so. It's actually quite a painless process :-)
newpersn Posted July 19, 2018 Author Posted July 19, 2018 do it, one at a time, good time to test your tolerance for 5 minutes or so. It's actually quite a painless process :-) Need a file for a service account ;/
BKGarry Posted July 19, 2018 Posted July 19, 2018 The file withing GADS or whatever it is now? You do all your settings in the wizard that you want, test it, run it and check it syncs how you want and then save the XML from there :-) That is the file you need
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now