GPO to disable saving passwords

[DSAGEY]

Hello,

 

Since moving away from Roaming Profiles I've noticed that Google seems to save the login details for G-Suite. IF a member of staff or child signs into their Google account and then signs out of the machine without signing out of their Google account the next time they login to the machine it remembers their login.

 

With Roaming profiles we didn't have this issue, if they signed out of the machine without signing out of Google they'd have to relogin to everything the following time.

 

I have setup the following GPO so it doesn't remember their passwords - I have tested it by signing in as a user and a Google account and signed out the machine without signing out of Google and it still remembered it.

 

This is the GPO I have done

 

Computer Config - Policies - Windows Settings - Security Settings - Local Policies/Security Options and enabled the "Network access: Do not allow storage of passwords and credentials for network authentication

 

User Config - Policies - Administrative Templates - Google/Google Chrome/Password manager and I Disabled the "Enable saving passwords to the password manager"

 

Is there something I have missed for this not to work?

 

Thanks

[mavhc]

Why do you want to disable this feature?

 

Which browsers?

[ThatBoringBloke]

Do they not have to sign into their account on the PC first? So it will only remember the passwords for the user who is signed into the PC or device?

 

It would create carnage for our staff never mind students if we disabled this.

Edited December 8, 2020 by ThatBoringBloke

[DSAGEY]

Do they not have to sign into their account on the PC first? So it will only remember the passwords for the user who is signed into the PC or device?

 

It would create carnage for our staff never mind students if we disabled this.

They do need to sign into their PC account first, but two members of staff use one login (shared - it's suppose to be used only for assemblies) but they keep staying signed in. For example, today a member of staff who last signed into their Google account on Friday was signed in today on Google yet they are not in school.

 

I only want it applied to shared logins ideally.

[DSAGEY]

Why do you want to disable this feature?

 

Which browsers?

Ideally I only want to disable this for certain logins as they are shared logins i.e. for visitors/supply so I don't want it to remember the Google account last signed in to that PC login.

 

We use Google Chrome.

[mavhc]

Run gpresult on the computer/login you're testing, check the gpo is applying

[free780]

Disable the VaultSvc Service. It might break some stuff.

 

You should really aim for SSO so the AD account they login to SSO's to G-Suite. Unless your doing something strange like generic Windows Logins (bad idea).

[TechMonkey]

You could set the profile to be cleared after one day, either by GPO or script. Or set a logoff script to delete the cache from the profile?

[Primus]

Disable the VaultSvc Service. It might break some stuff.

 

You should really aim for SSO so the AD account they login to SSO's to G-Suite. Unless your doing something strange like generic Windows Logins (bad idea).

 

On this subject I need to set this up in a new environment, has anyone got the guide they used to do AD SSO to G Suite login on Chrome?