Google Credential Provider for Windows (GCPW)

[TwistedHelixis]

I have been playing with GCPW with mixed results.

 

When I tested it on a non domain laptop, I get a G icon under the 'Other users' text on the Windows login page. This was great as it gave me easy access to both MS and Google as an option to login to Windows with.

 

I have just added the laptop to a domain but now all I seem to get is 'login with your work credentials', where the MS login box would have been, which when clicked opens the Google login box. It does this for all users including local users.

 

The only way to access the Windows login box is to select 'sign-in options' under 'login with your work credentials' and then select the windows icon key, which then brings up the Windows login box. this is not great for a primary school where half the pupils will not be using a Google account.

 

I am thinking that the GCPW software might have corrupted while joining the domain or something, so I might rebuild the PC.

 

Are others seeing similar behaviour?

[TwistedHelixis]

Apparently this is correct behaviour for GCPW :0(

[paulkerton]

Apparently this is correct behaviour for GCPW :0(

Well surely the idea of it is to replace your domain?

[dhicks]

this is not great for a primary school where half the pupils will not be using a Google account.

 

I haven't tried the GCPW with a domain-joined PC. If half your users aren't using a Google account, what are they using instead - generic logins of some sort? You could just re-create those in GSuite. I /think/ Windows might even let you auto-login a PC with a generic username / password to a Google account, might be worth trying.

[TwistedHelixis]

I do have an issue - Only users that are in G Suite and NOT associated with a domain account are able to login. If I try to login using a G Suite account that is associated with a domain account I get the following error - ‘no domain user could be found for your account’.

 

I have no idea why I am getting this error as I believe everything is setup properly.

 

EDIT

If half your users aren't using a Google account, what are they using instead - generic logins of some sort?

The school have decided that KS1 will not have g Suite accounts and don't need access to it.

Edited June 22, 2020 by TwistedHelixis

[dhicks]

The school have decided that KS1 will not have g Suite accounts and don't need access to it.

 

So is each pupil being logged in with a personal, Active Directory account, or are they using per-class AD accounts or something?

 

If your GSuite domain name matches your AD domain name then there might be some confusion - Windows will see a [email protected] as "username", logging in to the "yourschool.com" domain. I guess there might be some conflict between the standard Windows login handler and the new Google one both trying to be the default handler?

[mavhc]

Tell them to change their decision. Don't need to enable services like Gmail for every account, so why don't they want them to exist?

[paulkerton]

The school have decided that KS1 will not have g Suite accounts and don't need access to it.

 

On what grounds?

[edtechadmin]

Hi, it's been a while since you posted about an error that you had after setting up GCPW that says: No domain user could be found for your account. I am experiencing the same error, how did you resolve that issue?

 

Thanks!

[Primus]

Have you added the custom attribute to their Google accounts?

 

Roger's guide (https://wpsit.blogspot.com/2021/03/google-login-and-single-sign-on-to.html) is excellent.

[TwistedHelixis]

Hi, it's been a while since you posted about an error that you had after setting up GCPW that says: No domain user could be found for your account. I am experiencing the same error, how did you resolve that issue?

 

Thanks!

I gave up with the intention of trying again at some point.

 

Yes, I had set the reg key and still had the issue.

 

Please post back if you find an answer.

[TwistedHelixis]

And the custom attribute in Google workspace admin

[TwistedHelixis]

@edtechadmin let us know if you get it fixed :-)

[David44]

I've been struggling to get this to work this afternoon.

 

I can sign in to an AD joined Windows PC with Google credentials but it just creates a local profile, it doesn't sign me in with my AD account.

 

I have added the custom attribute to a couple of test accounts, although there are mixed messages about what these custom attributes should be called.

 

The Google documentation says it should be in a category called 'Enhanced desktop security' with a field called 'AD accounts' whereas everywhere else, including the guide linked to a few posts up, says 'Enhanced_desktop_security' and 'AD_accounts'. I have tried both with no luck. Could someone who has this working let me know what their custom attributes in Google Admin Console are called?

 

What about the value? What kind of thing do you have?

 

domain.internal/username

domain/username

 

Thanks.

David.