TwistedHelixis

I have found a post on Reddit that says the other free users have to use 2 step authentication for each logon, so based on that there are differences between a second account logging on with a license and a non licensed account.

I am honestly confused, as Google offer a free version, and I could have all my users log on for free, so what happens when a paid for user logs in first and then a free user logs in next, is my question?

Hi, We purchase GCPW standalone endpoint licenses individually. Do you know what the implications are if only the first user to logon to a GCPW device has a GCPW license and everyone else that logs in after doesn't have a license? I found the following License Scope: Any user who signs into a managed Windows device must have a license that supports advanced Windows management. But I thought the first person to logon, that also had a license, would mean the device is added to the Windows management, so I am a bit confused by this. Basically, all our Windows polices are deployed from a third party system, not Workspace, but I do need to have control over the user accounts being standard or admin from Google Workspace. Does anyone know what the above implications would actually be for the second non licensed user? Would I still be able to manage if the user was standard or admin from Workspace?

I have just noticed that in Workspace > Devices, some of my devices now have "Wipe Account", which.... Has any tested to see if this lets the next user to take over as the master account? Odd that this option is only on some of the devices.

OK, deleting the account is a much simpler method.

Think Ill try this out next

So I have managed to move the master profile from the old user to the current user. I believe I can remove some of these steps from the process below, so more testing... Make current user admin in workspace log onto device as a local admin Delete reg key HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Enrollment > Delete the Enrollment key. Reboot the machine. Login as current user In workspace delete new device from current users In workspace unenrol device from old users devices menu shutdown device until workspace lists the device as unenrolled. Login as new user New user should now be the master profile on the device.

Ohh that sounds interesting. Are there any steps that need to be completed before deleting the old user?

So after a few hours of playing, I think it was just the Chrome reg key needing to be deleted. HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Enrollment > enrollment key After deleting that, logged in and the new teacher is now the main account. Ill reset my test device and run through the process again, as I made a load of changes, so who knows which changes are the correct ones.

So I tried to use the Unenroll method posted above. The device does unenroll, but the new teacher never gets to become the master account. Does anyone have any other ideas or steps about changing the main GCPW account on a device?

Pupils are all on Chromebooks and staff all have the same profiles, so I was thinking of creating the accounts based on the device make, just to separate things out a bit. gcpwDell@ gcpwASUS@ etc Is this OK, or would you still go with staff@ etc?

Ill give this a go for now and let you know how it went.

Think Ill start doing this also. Do you know if there a limit to the amount of devices that the enrollment account can log onto? Would I need multiple enrollment accounts if I have over a specific amount of devices?

I have just been told that a teacher left a few weeks ago and their laptop has already been handed to a new teacher. With GCPW, the first teacher to log in becomes the 'settings deployment' account. How do I remove the old teachers account from the laptop, and make the current teachers account the 'settings deployment' account?

WOW that was fast. I keep reading horror stories on Reddit, nice to know its not always like that.

Yep, shared drives is always going to be an issue, not sure about the profile issue as my GCPW schools no longer have any servers.

Although it does kind of, provided the user has opened Chrome browser first, which is SSO, the user then just needs to click on their email address which should already be listed in Google Drive for Desktop. I did stumble on a script that auto logs into Drive for Desktop once the user has logged into Chrome Browser, no idea where that is, so perhaps AI can create something.

Just a side swing, but did you look into GCPW (Google Credential provider for Windows)? If you are a school its crazy cheap and replaces the Windows login system on laptops and PCs with a Google login box, and includes 2 step auth to log onto the device. GCPW also lets you manage the Windows devices and includes inTune device policy deployment from Google Workspace.

This, its far simpler than domain group policies, can be used to deploy updates, software and scripts and is completely free for 200 devices.

So far, I have been running round updating the BIOS on older laptops. Not even looked at the servers yet. What is the manual way?

ooh, that's sad 😢

Currently running on about 20 servers for the past 2 years and never had a service hang. perhaps its virus software or something causing it to hang.

Also, don't forget that GPO's are just registry changes at the end of the day. I have used an RMM to deploy scrips to endpoints that do exactly the same as the domain GPOs would have done. Things like account lockouts, time servers, proxy settings, printer deployments, mapped drives, all the security lockdown settings etc, can all be done using powershell and without an onsite DC. I think the free version of GCPW comes with making sure end users are all only standard acounts.

For us, all pupils are using ChromeOS, so its only the teachers that need an Endpoint Education Upgrade license. If you also needed all pupils to have a licence, then you would probably need the Standard licence upgrade.

Ohh, I see what you mean now. Google recently refreshed all the licences and separated out Endpoint Education Upgrade licenses for education, but these are only assigned to a user not a device. If they didn't add that as a feature when they refreshed their licenses, I dont think they will.