GCPW - Force AD password change?

[Shaun_Dark_Lord]

Hi All

 

I've been having a look at Google Credential Provider for Windows - Looks promising, and is mostly working. The custom Google attribute has been set on the Google accounts to link them to the correct AD account, and the correct GPOs and file permissions are applying.

 

However........

 

How on earth are password changes expected to be handled? Typically, we give a user a temporary password, they are prompted to change this at login, and their new password is sync to their Google account via Google Password Sync.

 

On a GCPW client, they log in to their Google account with the temporary password, accept the normal user agreement, and are then prompted for their existing AD account password - Which isn't the temporary password. At no point are they prompted to change their password, and can get no further than this prompt.

 

Am I missing something?

 

Thanks

[Shaun_Dark_Lord]

Anyone?

[paulkerton]

Are you using this alongside AD? Surely GCPW is a replacement for AD?

[Shaun_Dark_Lord]

In some instances, yes, this could replace AD. But it specifically supports logging into both Google and AD accounts at the same time, and everything works apart from password changes at login.

 

https://support.google.com/a/answer/9796679?hl=en&ref_topic=9539498

Edited September 23, 2021 by Shaun_Dark_Lord

[Primus]

This happens only if you force a password change. If you change their password without forcing them to change it on next log on it should work and they can then change it once they're logged on in the normal way.

[Primus]

Just to add if you really want to force them they can log on using AD creds instead of Google ones if this is Windows we're talking about - they choose sign on options and then hit the key icon. This will present a normal AD log on box. They'll then be forced to change their password and all subsequent log ons can be done using the Google log on.

[Shaun_Dark_Lord]

Thanks Primus - Unfortunately, I'm pretty sure that the majority of staff/students would just carry on using a default password.

[Primus]

If you use Salamander you can get them to set unique passwords - eg. SchoolInitialsDOB - so if your school was called Edugeek Academy and the kid was born on September 1st 2007 it would set their password to Ea010907 and then it's a bit more unique even if they don't change it.

[Shaun_Dark_Lord]

Am running custom script, so could do that. I'd still prefer the option of having the force password change actually work. Will report to Google.

[Primus]

Force will work but you have to get them to use AD the first time (or the time after any forced change).

[Shaun_Dark_Lord]

Update - Google now updating their GCPW documentation to reflect how the product actually works!