Signing into AD Computer with Google details.

[Jaan]

Hi All,

 

I've been looking at this for a while now. Anybody implemented this?

 

We use 2-step here for staff accounts so would be interesting to see how it handles that.

 

We have lots of Chromebooks onsite, so looking to remove the need for dual accounts and just streamline with Google accounts. This also negates the need to sign into Google onced logged into the windows pcs. Not tested Google drive stream (aka Google drive desktop), but would be awesome if users were automictically signed into that also!

 

Google Link

 

Edited February 7, 2022 by Jaan

[mavhc]

So login doesn't require paid Education Enterprise? nice, better than Microsoft with Azure AD then

[Jaan]

So login doesn't require paid Education Enterprise? nice, better than Microsoft with Azure AD then

 

Yeah we're on education fundamentals and have got it working in my test enviro. Just struggling to get the AD details sync'd into the Google admin panel vi the sync tool.

 

Look very odd seeing the google sign-in screen on a domain pc!

[mavhc]

I sync'd AD with GSuite ages ago. Would be interesting just for logging into a laptop when at home without needing cached passwords

[Jaan]

I sync'd AD with GSuite ages ago. Would be interesting just for logging into a laptop when at home without needing cached passwords

 

yeah we do that. We create the accounts in gsuite via the Google ad sync tool. However i need to add the domain user names into the google admin panel via the sync tool.

 

I just need to research this.

[rogerdnixon]

We use this at a number of our secondaries - my post about it: https://wpsit.blogspot.com/2021/03/google-login-and-single-sign-on-to.html

 

At others and all of our primaries that have Windows devices we use full on Google Advanced Desktop Security - so entirely managed in our MAT Google admin console.

[mavhc]

We use this at a number of our secondaries - my post about it: https://wpsit.blogspot.com/2021/03/google-login-and-single-sign-on-to.html

 

At others and all of our primaries that have Windows devices we use full on Google Advanced Desktop Security - so entirely managed in our MAT Google admin console.

 

Useful, thanks. The popup when you click an image is smaller than the original image on the page though.

[Jaan]

We use this at a number of our secondaries - my post about it: https://wpsit.blogspot.com/2021/03/google-login-and-single-sign-on-to.html

 

At others and all of our primaries that have Windows devices we use full on Google Advanced Desktop Security - so entirely managed in our MAT Google admin console.

 

Thanks for this.

 

I need to add the custom attribute to The Google admin panel. I wanted to use the Google sync tool to do this as i already use it. On your blog you reference this;

You can auto populate this field using GADS (Google Apps Directory Sync) if you use this to auto provision your accounts in Google from AD. Alternatively, you can populate them in bulk with a Google Sheets script or manually add them.

 

The link that's referenced to Google support doesn't really go into how to do this and Not found much on a Google search.

 

Any ideas on how to do this?

 

Just having a read through your blog now

 

Thanks

[mavhc]

"Note: For AD-joined devices, if the user doesn’t have an AD-backed Windows profile on the device already (so they have to click Other user to sign in), the device must be connected to AD for the user’s first sign-in."

 

Oh well. Still lets you change passwords I suppose.

[Jaan]

"Note: For AD-joined devices, if the user doesn’t have an AD-backed Windows profile on the device already (so they have to click Other user to sign in), the device must be connected to AD for the user’s first sign-in."

 

Oh well. Still lets you change passwords I suppose.

 

Also long as the PC is on the domain though, you can sign in with Google still, assuming the domain details have been added to Admin panel via the custom attribute.

[mavhc]

Also long as the PC is on the domain though, you can sign in with Google still, assuming the domain details have been added to Admin panel via the custom attribute.

 

But if they're on the domain, they can sign in normally. Only advantage is at home and forgotten password

[Primus]

But if they're on the domain, they can sign in normally. Only advantage is at home and forgotten password

 

Single Sign On for Chrome and Google Workspace apps is the major advantage here.

[rogerdnixon]

We use a Sheets script to add the attribute to the users in Google workspace. Script checks for new users in a certain OU and then adds the attribute to the user.

[PrimaryNetMan]

How do those using this manage 2FA, i understand that USB Keys aren't supported, but having to 2FA each time the machine locks isn't vaiable.

 

Other thak that, worked a treat. First time loggin in said my google password was different from my Local AD, entered the local AD and to changed to match the Google account, seamless.

[Jaan]

How do those using this manage 2FA, i understand that USB Keys aren't supported, but having to 2FA each time the machine locks isn't vaiable.

 

Other thak that, worked a treat. First time loggin in said my google password was different from my Local AD, entered the local AD and to changed to match the Google account, seamless.

 

What method did you use to add the user attribute to the Google admin panel. We'd like to use the sync tool.

[mavhc]

AIUI there's no AD default property you can sync for some reason, so you have to make one in AD, and use a script to go: for each user: set googleproperty = domain + "" + username