Migrate to 100% Google?

[rogerdnixon]

Thats basically it. Do your own testing of course to check its behaving as expected. Good luck with it.

 

btw - we push AnyDesk to our devices for remote support - works well.

[TheHyperTechie]

Hi @rogerdnixon,

 

I have been in touch with Google this morning and they are going to apply some standard licenses as a trial for our domain. This will give me a chance to test it correctly, before making making the final purchase.

[dhicks]

Currently, the sticking point is that, on startup, Google Drive starts after Windows Explorer, so if you try and redirect a user's home / Desktop folders the user gets an error message pop up on screen. Therefore, I'm trying to write (what I originally thought was) a simple, small application that loads Google Drive, then starts up Windows Explorer.

 

Okay: basic application written, although not extensivly tested yet:

 

https://github.com/dhicks6345789/application-starter

 

Further explanation and installation instructions are given at the above URL, but basically a small application that allows a user to log in to a Windows machine, connect to their Google Drive account and have their desktop redirected to that Google Drive account.

 

This should work for both existing users and new users of a machine. I've not tried this out on an already-used machine, only a freshly-installed Windows 11 test device. It should (I think) also work on Windows 10, although again that would be something more to test.

[timbo343]

Okay: basic application written, although not extensivly tested yet:

 

https://github.com/dhicks6345789/application-starter

 

Further explanation and installation instructions are given at the above URL, but basically a small application that allows a user to log in to a Windows machine, connect to their Google Drive account and have their desktop redirected to that Google Drive account.

 

This should work for both existing users and new users of a machine. I've not tried this out on an already-used machine, only a freshly-installed Windows 11 test device. It should (I think) also work on Windows 10, although again that would be something more to test.

 

Wow! I'd be interested in testing this out!!

 

@ssouth - could be something we roll out?

[dhicks]

Wow! I'd be interested in testing this out!!

 

Set up a test machine (please, don't try this on a machine you don't want to loose), start a command prompt as administrator, and run:

 

powershell -command "& {&'Invoke-WebRequest' -Uri https://www.sansay.co.uk/application-starter/install.bat -OutFile install.bat}" && install.bat && erase install.bat

 

Hopefully, that should be all you need - any issues, do please let me know as I've only been able to try this out on our school's specific setup.

[TwistedHelixis]

How do you create your users?

I think Arbor has a plugin that can provision users in Google Workspace, so no need for Salamander in this case.

[timbo343]

Set up a test machine (please, don't try this on a machine you don't want to loose), start a command prompt as administrator, and run:

 

powershell -command "& {&'Invoke-WebRequest' -Uri https://www.sansay.co.uk/application-starter/install.bat -OutFile install.bat}" && install.bat && erase install.bat

 

Hopefully, that should be all you need - any issues, do please let me know as I've only been able to try this out on our school's specific setup.

 

Will hopefully try it out next week and let you know.

[Danp]

Google based prep school, 300 pupils, one small server just to run papercut. DHCP via Sophos firewall

 

4 Windows PCs, local user, Google Drive setup.

 

Simple, nothing complicated, can never see myself running a Windows domain again, here or anywhere else.

[Olliedawg]

If Microsoft has no plans to extend support for Windows 10, I will be looking to move to being a Google school also. Going to cost us an absolute fortune to upgrade all of our PC's to be "compatible" with Windows 11 by Oct 2025.

[dhicks]

Will hopefully try it out next week and let you know.

 

I've made some changes to the way the Google Drive client mounts "G:" drive - each user's Google Drive is now mounted in "C:\Users\%USERNAME%\Google Drive" and each individual user's G: drive is then pointed at that mount point. This is instead of the default behaviour, where Google Drive simply mounts as the system-wide "G:" drive, meaning if you're on a shared machine (remote desktop) only one user gets a working Google Drive. I've tested this on a new Windows Server 2022 remote desktop setup, again further testing is needed.

[timbo343]

I've made some changes to the way the Google Drive client mounts "G:" drive - each user's Google Drive is now mounted in "C:\Users\%USERNAME%\Google Drive" and each individual user's G: drive is then pointed at that mount point. This is instead of the default behaviour, where Google Drive simply mounts as the system-wide "G:" drive, meaning if you're on a shared machine (remote desktop) only one user gets a working Google Drive. I've tested this on a new Windows Server 2022 remote desktop setup, again further testing is needed.

 

I've tested this on a machine, first installing Google Drive for Desktop then running the script via Administrator Command Prompt.

 

Upon restart i've noticed a Startup entry called FirstRun which is running when a user logs in.

 

Once the user logs in to desktop a black screen with the Google Drive for Desktop pops up and the user is asked to sign in to the browser.

 

I was hoping all this would have been done automatically so there was no user intervention but this would require Google to grab the password hash and authenticate with Google as i was thinking this would work with domains that have AD passwords sync'd up to Google.

[dhicks]

I was hoping all this would have been done automatically so there was no user intervention but this would require Google to grab the password hash and authenticate with Google as i was thinking this would work with domains that have AD passwords sync'd up to Google.

 

If you have the Google Credential Provider for Windows (GCPW) installed, any users that log on via that will have Google authentication cookies passed on to Google Chrome. That does make the whole setting-up-Google-Drive process a bit more streamlined, although the Drive client still has to ask the user for additional permissions (i.e. permissions to access their Drive, not just for logon).

 

The firstRun executable is added as a startup item for all users because that's the only way I could figure out to get it to run the first time a user logs on when it actually needs to. The other times it will just quit. The Drive mounting application (starter.exe) is run for each user the same time as Windows Explorer starts up - it promptly stops Explorer, waits for Drive to start and be available (typically takes a few seconds, hence the slight additional pause now when a user logs in), then mounts the (per user) G: drive and restarts Explorer.

[Tones]

If you're going with a Synology unit for the Google Backup note that you'll need the rack intel Xeon for processing if you're going for users not just shares.

If you do this, you can also put Docker on it and install PaperCut that way instead.

[dhicks]

If you're going with a Synology unit for the Google Backup note that you'll need the rack intel Xeon for processing if you're going for users not just shares. If you do this, you can also put Docker on it and install PaperCut that way instead.

 

Ah - we're looking at a Synology RackStation RS2423+ for Google Drive backup. That has an AMD Ryzen V1780B processor - do you mean there's some feature we won't have compared to the Intel version of the hardware?

[dhicks]

We got it working on a test (Windows 10) machine

 

Right: turns out that no Windows Credential Providers can handle USB-based 2FA keys as the Credential Provider seems to be sandboxed away from the USB interface - also discussed a bit in this other thread:

 

https://www.edugeek.net/forums/data-protection-information-handling/235945-2fa-schools-4.html#post2020109

 

Therefore, we've looked at a different solution, using pGina to have Windows machines authenticate against Google's LDAP service. Users should be able to log in to a Windows machine using their Google username and password - any 2FA steps won't be done at that stage, and there's no OAuth login token generated, so users will have to re-authenticate when they load up a browser / log in to the Google Drive client, but that's similar as to what would happen with a standard Windows domain account. So far, I've got a Windows 11 installer set up using Ventoy with a suitible unattend.xml file, I've managed to get the pGina Credential Provider installed and am figuring out the configuration setup.

[gszech]

Right: turns out that no Windows Credential Providers can handle USB-based 2FA keys as the Credential Provider seems to be sandboxed away from the USB interface - also discussed a bit in this other thread:

 

https://www.edugeek.net/forums/data-protection-information-handling/235945-2fa-schools-4.html#post2020109

 

Therefore, we've looked at a different solution, using pGina to have Windows machines authenticate against Google's LDAP service. Users should be able to log in to a Windows machine using their Google username and password - any 2FA steps won't be done at that stage, and there's no OAuth login token generated, so users will have to re-authenticate when they load up a browser / log in to the Google Drive client, but that's similar as to what would happen with a standard Windows domain account. So far, I've got a Windows 11 installer set up using Ventoy with a suitible unattend.xml file, I've managed to get the pGina Credential Provider installed and am figuring out the configuration setup.

 

This is on my things to do list. So all of the pGina and Ventoy is required because GCPW / Windows Credential Providers can't process 2FA YubiKeys ?

If so can I just use Google Authenticator or SMS text message to authenticate.

 

I've had a go at GCPW which worked fine. The only thing that didn't work was the fact that I've had to use two step verification each time to login to the same device.

[dhicks]

So all of the pGina and Ventoy is required because GCPW / Windows Credential Providers can't process 2FA YubiKeys ? If so can I just use Google Authenticator or SMS text message to authenticate.

 

Yes, exactly. Actually, I think I must have been using Google Authenticator on my mobile when I was testing a Windows build with GCPW, not realising that I'd need to test it with a USB 2FA key until I tried it on a different machine. Ventoy is actually for the building a USB-based Windows installer part of things, I've found it very handy - you can build a USB stick with the appropriate Windows ISO plus unattend.xml and any scripts / setup files you want and it handles making all that bootable. I have a server-side script build the set of setup / config files, so if I lose the bootable USB I can easily create another one.

[4bowmans]

dhicks I know this isnt a current thread but was just wondering if you ever got the gcpw/google drive working?

[dhicks]

was just wondering if you ever got the gcpw/google drive working?

 

If you log in to Windows via GCPW the Google login token will be passed into Chrome web browser (if installed), but not directly into the Google Drive client. You can set the Google Drive client to use Chrome to login, so when users start up the Google Drive client for the first time, all they really have to do is hit the "log in" button and "next" a few times, they don't have to re-do their 2FA step. The problem we found was that the Windows Login Provider system doesn't support USB 2FA devices - if you're okay with users using mobiles to log in then it should work okay.

[RLR]

If you log in to Windows via GCPW the Google login token will be passed into Chrome web browser (if installed), but not directly into the Google Drive client. You can set the Google Drive client to use Chrome to login, so when users start up the Google Drive client for the first time, all they really have to do is hit the "log in" button and "next" a few times, they don't have to re-do their 2FA step. The problem we found was that the Windows Login Provider system doesn't support USB 2FA devices - if you're okay with users using mobiles to log in then it should work okay.

 

Just looking at pGina for us. Are you able to screenshot your ldap settings? Tried doing what I think is required but can't get it to work.

[dhicks]

Just looking at pGina for us. Are you able to screenshot your ldap settings? Tried doing what I think is required but can't get it to work.

 

Just having a test machine install at the moment, I'll get some settings oof of that when it's done - I'll try and get to that tomorrow. Something I found after my last post here: we wound up needing to install stunnel as an LDAP proxy server - the local machines connect to stunnel, stunnel connects to Google LDAP. Once I'd figured out stunnel installation and configuration it's been running with no problems (on a Windows server) for the past year.

[dhicks]

Just having a test machine install at the moment

 

Sorry, turns out the test machine needed a bit more testing than I thought - disk failure. I'll be doing a different machine on Friday, I'll try and have a look then.

[RLR]

Sorry, turns out the test machine needed a bit more testing than I thought - disk failure. I'll be doing a different machine on Friday, I'll try and have a look then.

 

Yea, just read google article on this and says if the client doesn't support certificates then you need to setup stunnel. I'll have a go at getting this setup if I get chance.