Setting up Google Accounts for School

[newpersn]

Just been asked to create google accounts for a school that isnt setup with Google.

 

How do i start? I've done O365 but not google before.

 

Thanks.

[BKGarry]

i Followed these instructions https://support.google.com/a/answer/2856827?hl=en

 

 

Once I had our domain activated I used Google Active Directory Sync in order to synchronise all my AD users as a scheduled tasks, it also syncs our Salamander AD Sync Groups as well.

 

Then I installed GAPS, their password sync software, on each Domain controller and then when a user changes their password, it pretty much instantly (couple of seconds) synchronises to G Suite.

 

I have GMail disabled here, as we use Office 365 for email, and that receives all the Google Emails.

 

I hope that helps

[newpersn]

i Followed these instructions https://support.google.com/a/answer/2856827?hl=en

 

 

Once I had our domain activated I used Google Active Directory Sync in order to synchronise all my AD users as a scheduled tasks, it also syncs our Salamander AD Sync Groups as well.

 

Then I installed GAPS, their password sync software, on each Domain controller and then when a user changes their password, it pretty much instantly (couple of seconds) synchronises to G Suite.

 

I have GMail disabled here, as we use Office 365 for email, and that receives all the Google Emails.

 

I hope that helps

 

That does help

[BKGarry]

It was actually pretty pain free TBH.

 

You can set it up to authenticate against ADFS, but I never went that far, as Google Classroom didn't have custom URLs to redirect straight to the ADFS login page, where most the other services did, I don't know if that has changed or not.

 

I chose to stick with Google's own authentication, just for ease.

[dhicks]

Then I installed GAPS, their password sync software, on each Domain controller and then when a user changes their password, it pretty much instantly (couple of seconds) synchronises to G Suite.

 

We found there was some confusion about the "when a user changes their password" bit - the user needs to change their password in Windows / Active Directory for passwords to be synchronised, it does't pick up existing passwords. Over the summer might be a good point to reset user passwords to a known value that you can have teachers dish out at the start of term.

[BKGarry]

We found there was some confusion about the "when a user changes their password" bit - the user needs to change their password in Windows / Active Directory for passwords to be synchronised, it does't pick up existing passwords. Over the summer might be a good point to reset user passwords to a known value that you can have teachers dish out at the start of term.

 

GADS, the AD sync, does allow you to set a default password for G Suite users until they change their AD password.

 

for mass password resetting, this DOS command allows you to reset all passwords of users in a specified OU

 

DSQUERY user "OU=2011,OU=Students,OU=OU2,OU=OU1,DC=DOMAIN,DC=LOCAL" -limit 0 | DSMOD user -pwd 

[newpersn]

We found there was some confusion about the "when a user changes their password" bit - the user needs to change their password in Windows / Active Directory for passwords to be synchronised, it does't pick up existing passwords. Over the summer might be a good point to reset user passwords to a known value that you can have teachers dish out at the start of term.

 

GADS, the AD sync, does allow you to set a default password for G Suite users until they change their AD password.

 

for mass password resetting, this DOS command allows you to reset all passwords of users in a specified OU

 

DSQUERY user "OU=2011,OU=Students,OU=OU2,OU=OU1,DC=DOMAIN,DC=LOCAL" -limit 0 | DSMOD user -pwd 

 

Could you not use "User must change password on next login?"

[BKGarry]

Yeah you can for that one, that's what I would do as well.

 

But if you actually wanted to change all the passwords to the same you can use that command :-)

[dhicks]

Could you not use "User must change password on next login?"

 

We're a prep school, we find the younger children can struggle with password changes (they're generally fine by year 4, though).

[newpersn]

Just an thought.

 

Do you have to install GAP's on all DC's or can i do just 1?

[BKGarry]

GAPS goes on all your writing DCs.

 

Luckily, we only have two :-)

 

It is very lightweight.

[newpersn]

GAPS goes on all your writing DCs.

 

Luckily, we only have two :-)

 

It is very lightweight.

 

Nice. We only have 2 as well.

[Garacesh]

Make sure you disable non-admin password recovery!

It's in Security, Basic Settings, Enable/disable non-admin user password recovery ››

 

Google, in their infinite wisdom, allow you to enter an old password to access the password reset if you forget (or someone changes) the current one.

Except GCDS/GADS creates accounts with all the same password.

 

You can see the issue here,

[BKGarry]

Good shout there @Garacesh

 

I forgot to mention that too.

[newpersn]

More annoying.... Cant verify our domain even know i've added the txt in to our external DNS

[BKGarry]

Sometimes it takes a couple of hours for that to be detected at Google's end, something to do with replication and crawling.

 

Try verifying again tomorrow :-)

[ADMaster]

Make sure you disable non-admin password recovery!

It's in Security, Basic Settings, Enable/disable non-admin user password recovery ››

 

Google, in their infinite wisdom, allow you to enter an old password to access the password reset if you forget (or someone changes) the current one.

Except GCDS/GADS creates accounts with all the same password.

 

You can see the issue here,

 

Can I get a visual on this, I've never seen or heard of this setting before. However I do have passcore setup. Its not true SSO, but users are directed to it instead of googles change password page.

I tried to say I forgot my password, entered an old one and was asked to contact my administrator.

 

Thanks,

[Garacesh]

Huh, weird.

At a guess, I'd suggest it might not be available if you're using an SSO solution without any kind of writeback capability. But that's just a guess.

 

[newpersn]

All verified now.

 

Just need to reboot the DC's for GAPS... (May do one at a time and see if anyone notices....)

[BKGarry]

do it, one at a time, good time to test your tolerance for 5 minutes or so.

 

It's actually quite a painless process :-)

[newpersn]

do it, one at a time, good time to test your tolerance for 5 minutes or so.

 

It's actually quite a painless process :-)

 

Need a file for a service account ;/

[BKGarry]

The file withing GADS or whatever it is now?

 

You do all your settings in the wizard that you want, test it, run it and check it syncs how you want and then save the XML from there :-)

 

That is the file you need