Chromebook local password

[David44]

Is this normal?

 

A user signs in to a managed Chromebook for the first time with their school Google account and password. The Chromebook now has their profile on it, in future they just click their name and enter their password to sign in. At some point, they change their Google account password (let's say from a PC or a phone). Now when they try to sign in to the Chromebook, they still need to use their old password to sign in. The Chromebook itself will report "If you recently changed your password, use your old password. Your new password will be applied once you've signed out" which also doesn't seem to be quite true. The new password only seems to be applied if the profile is removed from the Chromebook and the user adds their account/profile again by signing in again with their Google account using the new password.

 

When the helpdesk change a students password, we have also taken to resetting the Chromebook from the Google Management Console to remove all the local profiles as this is easier than explaining to a student that they need to use their old password (which they have probably forgotten as that is likely why we are changing it).

 

What do you do? How do you make this work for users?

[Oaktech]

Can you try setting 'Sign in screen' to 'never show usernames and photos' this is what all 4 of my deployments are set to and your scenario has never occurred for us.

[mcolbourn]

Can you try setting 'Sign in screen' to 'never show usernames and photos' this is what all 4 of my deployments are set to and your scenario has never occurred for us.

 

This is what we do here too.

 

What you describe is by design if I remember correctly. On a Chromebook when you log in as an user your profile on that Chromebook is encrypted with your password this is so you can log in locally if its has not online connection. Now when you change your google password the next time you log in it has to decrypt (you have to supply your old password) and then re-encrypt with your new password. Please correct me if I am wrong here.

[David44]

Can you try setting 'Sign in screen' to 'never show usernames and photos' this is what all 4 of my deployments are set to and your scenario has never occurred for us.

Yes, this does seem to resolve the issue, the user can sign in with their recently changed Google password rather than what is cached on the Chromebook although it means the user also has to type their username/email address in each time and as these are one to one devices, that is an extra step for them that we don't currently have. Not the end of the world though. It might be something we can implement on the new Year 7 device OU in September as those users won't know any different.

 

 

This is what we do here too.

What you describe is by design if I remember correctly. On a Chromebook when you log in as an user your profile on that Chromebook is encrypted with your password this is so you can log in locally if its has not online connection. Now when you change your google password the next time you log in it has to decrypt (you have to supply your old password) and then re-encrypt with your new password. Please correct me if I am wrong here.

 

That isn't quite what I described, although we do see this too and annoying as it is, it makes sense why it happens (and still happens with the setting suggested by @Oaktech above).

 

It's shame that Google don't let us set it so that the password is checked against Google every time (with maybe a backup of checking the cached password if the device is offline) and making it more obvious that you don't actually need the old password, or better yet don't ask for it at all, if you don't store anything of importance locally.

 

Google seem to support sign-in apps, to allow sign in with cards/biometrics etc. I wonder if it would be possible to create an app that offers a more user-friendly sign in process. I wonder if someone has already done so.

[PotNoodleTech]

Can you try setting 'Sign in screen' to 'never show usernames and photos' this is what all 4 of my deployments are set to and your scenario has never occurred for us.

 

This. This is how we run it.

 

If a pupil changes their password, if they are already logged into the chromebook it would be with their old password, it may prompt for the new pasword at some stage. Once they sign in with their new password the chromebook will ask them to type in their old password in order to unlock their old profile. If they can not remember this they must click forgot and then proceed. A new profile will be created on the chromebook with their new password and any data from their old profile that has not been uploaded to google drive willl be lost.

 

There's no way round that bit as the chromebook profiles are encrypted and linked to the password at the time so you forget your old password - no decrypt for you.