Google Cloud Directory Sync

[bhartleyy]

Hello

 

I have GCDS running, all working amazing, but when our school AD accounts are disabled e.g. Student or Staff has left, this change does not go up to Google so their account is still enabled.

 

Google support can't understand what I am trying to do!

 

These are the settings below:

 

 

Thanks

Billy

[caffrey]

I have mine set like this :- Any accounts disabled or missing in AD are suspended on Google Workspace

 

[Jaan]

Mine doesn't disable any accounts in Google even if they are disabled in AD.

 

They have to be removed from the monitored OU in AD for Google to disable them.

[caffrey]

Yes sorry, forgot that I have search rules that if an account is disabled in AD then suspend it in Google

[Jaan]

Yes sorry, forgot that I have search rules that if an account is disabled in AD then suspend it in Google

 

Would be interested to know more about this

[Chaniel]

Mine doesn't disable any accounts in Google even if they are disabled in AD.

 

They have to be removed from the monitored OU in AD for Google to disable them.

 

Our LDAP Search Rule for staff is the following:

(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

 

Should only pick out the users that aren't disabled, any disabled users it won't find so will suspend.

[bhartleyy]

Thanks all, have changed ours and it's now working

[MS2011]

Hello

 

I have GCDS running, all working amazing, but when our school AD accounts are disabled e.g. Student or Staff has left, this change does not go up to Google so their account is still enabled.

 

Google support can't understand what I am trying to do!

 

These are the settings below:

 

[ATTACH=CONFIG]62402[/ATTACH]

 

Thanks

Billy

 

Hi

 

I’m working on GCDS as well, did you need to ask all your users to reset the password once GCDS installed?

[paulkerton]

I’m working on GCDS as well, did you need to ask all your users to reset the password once GCDS installed?

GCDS will only synchronise the accounts. If you want to synchronise your passwords you will need to install Password Sync on every AD too.

https://support.google.com/a/answer/2611859

 

And yes, it can only sync passwords when it steps in the middle, so you'll need to get everyone to reset their password also.

[MS2011]

GCDS will only synchronise the accounts. If you want to synchronise your passwords you will need to install Password Sync on every AD too.

https://support.google.com/a/answer/2611859

 

And yes, it can only sync passwords when it steps in the middle, so you'll need to get everyone to reset their password also.

 

Thanks

 

When you implement at your place, how did it go? Did you force change password at next login?

[paulkerton]

Thanks

 

When you implement at your place, how did it go? Did you force change password at next login?

 

We didn't implement at our place, as the students only use Google accounts.

I've implemented it for others though (old job) and yes, force password change at next login to start syncing.

[MS2011]

We didn't implement at our place, as the students only use Google accounts.

I've implemented it for others though (old job) and yes, force password change at next login to start syncing.

 

[emoji106]

[MS2011]

GCDS will only synchronise the accounts. If you want to synchronise your passwords you will need to install Password Sync on every AD too.

https://support.google.com/a/answer/2611859

 

And yes, it can only sync passwords when it steps in the middle, so you'll need to get everyone to reset their password also.

 

Good morning

 

I have installed GCDS on a VM and configured, all working good. For password sync I need to install on out two DC’s, right ?

 

Thanks

[paulkerton]

Good morning

 

I have installed GCDS on a VM and configured, all working good. For password sync I need to install on out two DC’s, right ?

 

Thanks

 

Yes, password sync needs to be installed on every DC, as Windows Server automatically load balances password changes between your DCs.

[caffrey]

Bonus tip, prevent users from changing their passwords from their Google account or you could run into issues (Like radius authentication) And because GWPS is a one way street

 

You need to go into the admin panel (https://admin.google.com/ac/security/sso) and set the change password url to something else - I have it set to google.co.uk for instance, leave everything else unchecked

[paulkerton]

Bonus tip, prevent users from changing their passwords from their Google account or you could run into issues (Like radius authentication) And because GWPS is a one way street

 

You need to go into the admin panel (https://admin.google.com/ac/security/sso) and set the change password url to something else - I have it set to google.co.uk for instance, leave everything else unchecked

 

Even better, set it to a Google site of your own making, telling them to change it on Windows on-site.

[Chaniel]

Bonus tip, prevent users from changing their passwords from their Google account or you could run into issues (Like radius authentication) And because GWPS is a one way street

 

You need to go into the admin panel (https://admin.google.com/ac/security/sso) and set the change password url to something else - I have it set to google.co.uk for instance, leave everything else unchecked

 

Just had a thought (danger!), you could change the URL to your RDS Change password setup (if you use RDS). For example, "https://remote.school.org/RDweb/Pages/en-GB/password.aspx".

 

Shouldn't make things any less secure? If you change your password via RDS, it'll update in AD and then sync to Google via Password Sync.

[caffrey]

Even better, set it to a Google site of your own making, telling them to change it on Windows on-site.

 

Not a bad shout, easily knock something up in Google sites I guess

[MS2011]

Bonus tip, prevent users from changing their passwords from their Google account or you could run into issues (Like radius authentication) And because GWPS is a one way street

 

You need to go into the admin panel (https://admin.google.com/ac/security/sso) and set the change password url to something else - I have it set to google.co.uk for instance, leave everything else unchecked

 

[emoji106]

[MS2011]

Yes, password sync needs to be installed on every DC, as Windows Server automatically load balances password changes between your DCs.

 

Thank you.

[MS2011]

Good morning

 

We have few shared mailboxes on exchange, once we migrate to gmail, how do I set them up?

 

In outlook, shared mailbox appears in same window access by the user.

[caffrey]

I've found it better to create seperate mailboxes, then just give access details to the users that need it. This can then be opened in a separate tab.

 

Makes more sense for departments, and it works well e.g. no double answered emails etc. And helps when staff leave

 

You can create these as either AD accounts, or just create an OU in the admin panel with non domain accounts in it and create the mailboxes there