Google's Windows 10 MDM out of beta

[rogerdnixon]

If you use G Suite and have Windows 10 devices, you might be interested in this https://gsuiteupdates.googleblog.com/2020/04/enhanced-security-windows-10-google-login.html

 

We have been an alpha/beta tester and I've put some info into this blog post: https://wpsit.blogspot.com/2020/02/google-mdm-for-windows-10-devices-more.html

 

We are now using this as our default way of managing Windows devices in our Trusts primaries. Its worth noting you do need some (we have 10), Enterprise licences for the accounts involved in managing devices - but regular users do not need them. So as a management solution its pretty cheap. We combine this with Papercuts (users sync from G Suite) print deploy for printer management.

 

It's not perfect - but developing rapidly and great for an almost serverless school setup (we do have a print server...) and the built-in SSO is really good.

[caffrey]

Think I might have a play with this today in a VM

[RebelBurr34]

Think I might have a play with this today in a VM

That sounds good.

[caffrey]

Had a quick play, I can really see the potential but would need a complete paradigm shift of working at the school. It's a real shame this didn't come out earlier, would've really helped with school laptops and teachers working from home too. All they would need is a basic windows 10 install and this with drive sync and it would've been fine, although I got round it by installing neverware on them

[paulkerton]

For older devices, I would definitely go Neverware if you're already a Google school. I would only be using this for those departments/areas that insist on remaning with Windows due to specialised software. ChromeOS and Chromebooks is where we're headed as a school, so where we're stuck with legacy software for now, I can see a real benefit to this.

I do wonder how the Enterprise side of it works with part-licensed establishments though? Any ideas?

Edited April 29, 2020 by paulkerton

[Arthur]

I do wonder how the Enterprise side of it works with part-licensed establishments though? Any ideas?

For the devices you didn't want to manage through G Suite you would need to enable GCPW standalone mode during deployment. See the second link for the relevant registry value to set. This would still let you use the login and SSO features.

 

www.edugeek.net/forums/windows-10/212826-authenticate-windows-10-devices-gsuite-enterprise.html#post1839325

 

https://support.google.com/a/answer/9250996#registry_keys

[caffrey]

Yep, you have to use those keys to set the domain too

 

I only did limited testing, but it works