Tips/Pointers on Google Workspace for Education setup

[Tom_P]

Hello!

 

We are using an Azure hybrid AD environment with O365. All desktops/laptops are on windows 10/11 and have around 200 ipads managed through an MDM. We are also currently in the process of shifting the local shared data across to sharepoint.

 

Recently the school have been pushing to start using Google Workspace and chromebooks. ive been reluctant in doing this mainly because we still have much work to do with O365 and sharepoint and not to mention the training involved with introducing the change to sharepoint and introducing google with the teachers.

 

Therefore we have come to an agreement that the work with sharepoint will be put on hold and we trial out Google.

 

My previous experiance with an O365 and Google environment has not been good. I think this has mainly been down to google knowledge on my part and a poor setup from my predecesors.

 

I am using some free training resources online to better my understanding and been looking into taking a short course on it.

 

Any tips on the best way to set this up from the beginning and any 'dos and donts' will be greatly appreciated. I'd like to get this right from step 1

[Zbd]

We are an iPad school that jumped to Google during lockdown mainly for Classroom and drive. I don't mind it. A couple of the teachers had used Google before and that was super helpful as they handled the Teaching related queries. We still use iPads in school and not Chromebooks so cant help at all with that side.

 

We have a VM that sinks up the users and passwords to Google from AD every hour without issue.

 

You can get some training here for the Admin side if you sign up for the Month free trial with skill boost:

https://www.cloudskillsboost.google/quests/168

 

I would set up a GAM install on console.cloud.google.com and learn to use it. It's free to use on the console, and it doesn't have to contend with your school filtering.

 

Some commands can be found here:

https://sites.google.com/jis.edu.bn/gam-commands/services/drive.

 

Google Classroom Admin is pretty much non existent on Google Admin as far as I'm aware, so if we have to do anything we have to use GAM for it. We also use GAM at the start of the year to port all the classes from our SIS via CSV.

[Tom_P]

@Zbd - Thank you! Some great insights there, I will look into these thanks.

 

We have a VM that sinks up the users and passwords to Google from AD every hour without issue.

 

What do you use to handle the syncing? Ive been looking at Sims ID as that facilitates both Google and O365 with SSO.

[ADMaster]

I've been using Google so long going back to step 1 to cover everything will be difficult.

Here are a few high level things to get you started.

Let the sync tool handle user creation. A combination of Google Cloud Directory Sync and Google Apps password sync.

GCDS just goes on one server and works similar to Azure AD connect. It will sync Users, Groups and OUs based on your rules.

GAPS will need to go on all domain controllers as it is a password filter dll.

Then I'd just spend some time in the admin console getting the settings the way you want them. Create a few test users for this if need be. I have a user I move from OU to OU for varies testing scenarios.

 

The few areas you will want to cover are Google apps and services.. Turn off what you don't want students using. Maybe GMail if you use O365 for mail.

 

Go through the chrome settings and secure them. No incognito, task manager, set the home page etc.

 

If you will use GMail, look at all the safety / spam settings and restricted delivery.

 

In general just skim through everything most items are intuitive enough and or have good help linked.

 

Then as said above you can use GAM for bulk actions and some items you cannot do in the web interface.

[Tom_P]

@ADMaster - Thank you!

[Zbd]

@Zbd - Thank you! Some great insights there, I will look into these thanks.

 

 

 

What do you use to handle the syncing? Ive been looking at Sims ID as that facilitates both Google and O365 with SSO.

 

Yes, we use Google Cloud Directory Sync. It was all setup before I started.

[Koldov]

From my own personal experience I found it vast... but as with most things it was a bit trial and error. We had a teacher's OH who used it in another school, so luckily a lot of the 'Classroom' stuff was dealt with amongst the teachers and SLT. But as usual it comes down to the tech to know everything about everything and get the whole admin part set-up and working (and configured correctly and safely) while at home during the first lockdown!

 

Mostly finding out I hadn't configured a setting because quite frankly I didn't know it even existed... only after reading something on here and going in to check our platform did I realise I should have a particular setting on (or off)!

 

Like realising someone had linked their 'OnlyFans' account (among other things) to their Google Workspace account... Restriciting YouTube, Gmail (if you are using it), who can access what 'app' and who can share what and with whom (and securing Domain only sharing etc.) OUs, Groups...

 

Luckily for me we aren't an all-in Google school and only use it sparingly (mostly for remote learning in the lockdown and for some homework) so I didn't go for the whole having to learn GAM thing thankfully, but it still needs a fair amount of effort to configure and thought on who is using what parts of it and how.

[Tom_P]

Mostly finding out I hadn't configured a setting because quite frankly I didn't know it even existed... only after reading something on here and going in to check our platform did I realise I should have a particular setting on (or off)!

This is exactly what I'm expecting to happen with me! My aim is to roll it out slowly - thankfully i dont have the pressure to set this up ASAP for home teaching/learning as they currently have that with O365.

[Zbd]

This was posted elsewhere by someone on Edugeek, I forget where now, but it takes you through installing GAM on Google Cloud: