How do you...provision new GSuite accounts?

[EmperorPeng]

I am having real problems synching our AD changes to GSuite. We have both Google Cloud Directory Sync and GSuite Password Sync installed as per requirements.

 

The only way I've gotten it to work at the moment is as follows:

 

1. Log into pupil Google account

2. Log into pupil AD account

3. Change pupil AD password which then updates the GSuite password

 

If I do it any other way, the password changes do not sync.

 

I really do not want to manually log into 700 GSuite accounts - what am I doing wrong/how do you do it?

 

FYI we are using the standard free version of GSuite for EDU with our LAN using Server 2012/2016/2019 with Windows 10 clients.

[aicrd]

If you reset the passwords via AD users and computers does it not also sync? It should do if you set the passwords to not reset at login.

 

You could also use a bulk password editor for AD. There's loads that can do it. I believe ManageEngine have something for it

[caffrey]

Google password only syncs on change - you also need to install it on all DC's.

 

We give students a temporary account password and they change it on first login - this then syncs to their google accounts

 

Unless there is some other way! This is the way we've always done it

[aicrd]

Not sure what you mean. Can the pupils not just login to the accounts? If not, why not just give them passwords via AD? You yourself shouldnt need to login to the accounts. G Suite will sync when a password change is detected. Thats either the pupil or you changing it in AD

[jthompson]

Are the new AD passwords perhaps too simple? We've noticed that GSPS won't sync a password that's to short, for instance.

 

Our process is:

• Create new AD account with generic password.
  
• Run GCDS to provision new G Suite accounts. Our GCDS config applies a generic password for newly created accounts.
  
• Users sign in to Windows and are prompted to change their password.
  
• GSPS syncs the new password, ready for their first Google login.
  

[aicrd]

I believe its because you set the passwords to be forcibly changed on login. G Suite won't sync that. You'd have to set the passwords but make sure they don't require to be changed on login.

 

Its not anything to do with complexity as I've seen people use ridiculously short passwords in some places!

[jthompson]

Interesting. GSPS doesn't have any issue with the AD 'change password on next logon' option being used here. We use it all of the time. Next time the AD user signs in and sets a new password, GSPS mirrors that password change to the Google account as expected.

 

There should be some logs being generated by GSPS somewhere. I can't recall where.

 

Another thought is whether or not your Google accounts have the equivalent 'change password on next sign in' option set when the accounts are first created by GCDS. That may prevent the initial GSPS password sync from succeeding. I believe there's an option within the GCDS config to ensure that that option isn't set for newly created accounts.

[aicrd]

Sorry what I actually meant is if you set "Change password on next logon" the students may not be able to login to G Suite until they login to Windows and change the passwords themselves.

 

Therefore, instead of logging on as each student to reset the password and force the sync, you simply reset the passwords in AD without that option checked and it should sync up to G Suite.

[timbo343]

We"ve just bought the Azure P1 license for our staff and you get 15 student accounts free staff account.

 

This means students can register their google email address on our Azure AD and reset both network and gsuite password at the same time outside of the network. The write back feature of P1 means Azure talks to our OnPrem AD, then that kicks google too. It's pretty much instant TBH.

 

At registration you can set what additional authentication you want to ask the user for. I still need to run this via the powers that be but for less than £6 per user per year (for the staff accounts) i didn't think itvwas too bad. Just got some questions asked when it came to the finance team - do you really need it?

Edited September 8, 2020 by timbo343

[EmperorPeng]

I am having real problems synching our AD changes to GSuite. We have both Google Cloud Directory Sync and GSuite Password Sync installed as per requirements.

 

The only way I've gotten it to work at the moment is as follows:

 

1. Log into pupil Google account

2. Log into pupil AD account

3. Change pupil AD password which then updates the GSuite password

 

If I do it any other way, the password changes do not sync.

 

I really do not want to manually log into 700 GSuite accounts - what am I doing wrong/how do you do it?

 

FYI we are using the standard free version of GSuite for EDU with our LAN using Server 2012/2016/2019 with Windows 10 clients.

 

Problem solved. The service on two of our DCs was crashing. I removed the software, rebooted the servers, reinstalled the software, rebooted again and set it back up. Everything working flawlessly now. Passwords are in sync within 5-10 seconds.

 

Many thanks to everybody who took the time to respond

[localzuk]

I use the Google gcds sync tool, and SimpleSaml.php for the actual signing in SSO.

 

That way, passwords are never actually in G Suite its all handled by our AD.

 

Currently pondering migrating from SimpleSaml.php to LogonBox too.