GCPW - Does it make a difference if its my account that is always the first one to log in?

[TwistedHelixis]

I know the first account to log into a Windows device that has Google credential provider installed, becomes the Master account.

 

All the setup steps suggest getting the actual device user to log in first.

 

I am just wondering what the implications are if its always the same account that logs in first?

 

Does anyone do this already, or do you always get the owner to login first?

 

 

 

 

Edited May 7, 2025 by TwistedHelixis

[TwistedHelixis]

Is it due to any other users getting the same settings as the first user that logs in?

[paulkerton]

14 minutes ago, TwistedHelixis said:

Is it due to any other users getting the same settings as the first user that logs in?

Its exactly this. The first one to log in is the enrollment user. Whatever settings are applied to the OU that user is in, will apply to all users.

[TwistedHelixis]

So I could in theory, create a GCPW teacher acc, log into all the devices first, then hand those devices out to the staff?

[paulkerton]

3 minutes ago, TwistedHelixis said:

So I could in theory, create a GCPW teacher acc, log into all the devices first, then hand those devices out to the staff?

Yes, and then you set the policies against the OU that account is in, and whenever those policies change - they will be pushed to anyone where that GCPW teacher account was used as the first login.

Just remember the GCPW teacher acc would need an Edu Plus license assigned too!

[TwistedHelixis]

Thanks Paul.

I created a policy to hide some menu settings, but hey are still displayed on the laptop after logging in with my GCPW acc. Not sure if its a sync issue or policy creation issue.

 

Do you have that one policy you have created, that you can always check has applied, so you know it must be syncing?

 

 

[paulkerton]

Our set up is a little messier than that sadly, but that is essentially what we do - One OU for Staff, one for Student, per site.
We then check any issues in the Device log events in the Investigation tool.

[TwistedHelixis]

I managed to get the policy to apply which removed the Gaming tab from Windows settings page. So I now have a good way of instantly knowing if the policies are applying or not.

[TheHyperTechie]

1 hour ago, TwistedHelixis said:

Thanks Paul.

I created a policy to hide some menu settings, but hey are still displayed on the laptop after logging in with my GCPW acc. Not sure if its a sync issue or policy creation issue.

 

Do you have that one policy you have created, that you can always check has applied, so you know it must be syncing?

 

 

Make sure you logout and reboot the device, this is *usually* enough to force a sync.

[TwistedHelixis]

Just thought of a possible issue.

 

I know the policy settings are only applied to the first user account, and I believe also the Windows settings, like updates or bit locker settings etc.

If I login first to all staff devices using a staff device setup account, will I then be able to make a specific user that has subsequently logged in, a local admin for a short while using the Workspace admin settings? Or would I need to make my account local admin, which would then make all accounts on all device local admin, which is not good?

 

EDIT - If i am the first user to login, can I later make other user of just that device a local admin?

Edited May 8, 2025 by TwistedHelixis

[TheHyperTechie]

10 minutes ago, TwistedHelixis said:

Just thought of a possible issue.

 

I know the policy settings are only applied to the first user account, and I believe also the Windows settings, like updates or bit locker settings etc.

If I login first to all staff devices using a staff device setup account, will I then be able to make a specific user that has subsequently logged in, a local admin for a short while using the Workspace admin settings? Or would I need to make my account local admin, which would then make all accounts on all device local admin, which is not good?

 

EDIT - If i am the first user to login, can I later make other user of just that device a local admin?

Yes, you would just need to move the particular user into the Administrators OU (assuming you have one) and then target the permissions to that OU. Any user in it will then gain local admin rights to the machine. As you mentioned, you do not want to log in first with your account as this will grant any user who logs in after you local administrator access.

 

Worth noting with GCPW and permission settings, I found that signing in, then out, then back in would force the user to have local admin permissions.

[TwistedHelixis]

OK, so I am still not getting this.

 

I logged onto the laptop first with my setup account.

 

Next I logged into the laptop with a teacher account.

 

then, I moved the teacher account into a new OU with admin rights enabled.

 

After a few reboots, the teacher now has admin access on the laptop.

Is this the expected behavior?

 

I thought that the only account that could be affected by the policies and the Windows settings was the first account that logged onto the laptop, and all other accounts that would logon would just get those same settings.

I'm now really confused.

Edited May 8, 2025 by TwistedHelixis

[TheHyperTechie]

21 minutes ago, TwistedHelixis said:

OK, so I am still not getting this.

 

I logged onto the laptop first with my setup account.

 

Next I logged into the laptop with a teacher account.

 

then, I moved the teacher account into a new OU with admin rights enabled.

 

After a few reboots, the teacher now has admin access on the laptop.

Is this the expected behavior?

 

I thought that the only account that could be affected by the policies and the Windows settings was the first account that logged onto the laptop, and all other accounts that would logon would just get those same settings.

I'm now really confused.

This would be expected, you have targeted the admin permissions to the OU that contains the teacher. You can remove them from that OU at any point, and they will lose admin access.

 

EDIT - I understand what you mean, as your essentially saying... If I have logged in with a standard account (that has standard permissions) to set the device up, subsequently, any account that signs in after should be a "standard user". I am unsure why adjusting the permissions after works, GCPW can be a "headache" sometimes!  

Edited May 8, 2025 by HyperTech

[TwistedHelixis]

Yes, I thought that if I wanted the teacher to be local admin I would need to move the set-up account into the admin OU, which I assumed would then make the teacher an admin, but after testing I can just move the teacher into an admin OU, which is perfect.

[TheHyperTechie]

1 minute ago, TwistedHelixis said:

Yes, I thought that if I wanted the teacher to be local admin I would need to move the set-up account into the admin OU, which I assumed would then make the teacher an admin, but after testing I can just move the teacher into an admin OU, which is perfect.

Yeah it is handy, but also appears to be the exact opposite of what their guide says haha! 

[TwistedHelixis]

3 minutes ago, HyperTech said:

Yeah it is handy, but also appears to be the exact opposite of what their guide says haha! 

This is why I have been going round in circles for ages. Their help page literally says this isn't possible 😭