G Suite forces students to change their password on first sign in

[Sonic3]

We have G Suite for Education set up and AD accounts/groups/OUs/etc. and passwords synced using GCDS and GSPS. All students have had to change their AD account passwords since then and I can confirm that the password syncronisation is working. However, when a student first logs in to G Suite, it forces them to choose a new password! This, of course, means the password is different to their AD account password (kind of defeating the object) and it won't let them use their current AD account password.

 

Is there any way to stop G Suite forcing students to change their password on first/next sign in? That is, without having to manually change each password ('cause that's the only place I see the 'must change password at next sign in' toggle switch) and then have each student change their AD password just to get them in sync!

 

I've looked into ways to reset multiple passwords in G Suite/Google Cloud at once but GAM ( https://github.com/jay0lee/GAM ) and Google Cloud Shell won't connect (probably because they can't get through the LEA's firewall).

[Arthur]

Do you have the option highlighted below checked?

 

[bald_pig]

Now you will have to do it manually, but in GCDS, under User Accounts -> Additional User Attributes, uncheck "Force new users to change password"

 

Basically, when you sync the new password, it doesn't clear the flag.

 

*EDIT* Dammit @Arthur!

[Arthur]

*EDIT* Dammit @Arthur!

I might have been too fast since I don't think @Sonic3 saw the screenshot?

Edited July 9, 2019 by Arthur

[Sonic3]

I might have been too fast since I don't think @Sonic3 saw the screenshot?

That is correct. But thanks to both of you!

 

However, loading up GCDS again it looks like the box wasn't ticked but I can't be 100% sure it wasn't ticked at the time I did the initial syncronisation, so this may be the solution for those lucky enough to find this post before making the same mistake as me!

[Arthur]

Did the user accounts exist in G Suite prior to the AD users changing their passwords?

 

Btw, if you do get GAM working the following command will quickly turn off the forced password change on next logon for all users.

 

gam all users update user changepassword false

[Sonic3]

Did the user accounts exist in G Suite prior to the AD users changing their passwords?

 

Btw, if you do get GAM working the following command will quickly turn off the forced password change on next logon for all users.

 

gam all users update user changepassword false

 

Yes, the user accounts existed, GSPS set up, and then all students were required to change their AD password.

 

I think my only option is to use GAM over a 4g mobile data connection! Thanks for the command line example. Will try that

[Sonic3]

Btw, if you do get GAM working the following command will quickly turn off the forced password change on next logon for all users.

gam all users update user changepassword false

Managed to get GAM set up on a live Linux USB (to save from Win 10 using all my mobile data in 5 minutes) and it's running that command now. Fingers crossed!