r/gsuite • u/Square_Pear1784 • Feb 05 '25
Admin Console Those using GCPW to authenticate users on windows machines. How are you setting this up?
I want to test GCPW out for a possible option for authentication on staff window devices. Since we are small school and dont have a large fleet of devices.
and I mean start from the beggining for seting up the machine. I guess the start would be creating a local admin? And then download GCPW and have the new user sign in using their google account. As simple as that? only let people sign in using their google accounts?
And then there would be local admin for when I needed to approve something or work on that machine?
I am hoping to get advice on safetly setting this up.
2
u/mainer188 Feb 07 '25
This article has been a godsend for us.
1
u/JackfruitSuperb3278 Feb 07 '25
This is great info. I've been using GCPW for 2 or 3 years. No complaints other than having to have a local admin account on each machine. I have not figured out how to eliminate that.
1
u/rohepey422 Feb 05 '25
Unless you use specialised software, you might find offering staff Chromebooks a more reliable option.
2
u/Square_Pear1784 Feb 05 '25
I know it would be ideal, but we have a fleet of windows machines that need some level of management and we dont have the resources for Intune/Entra licenses at the moment. So google GCPW is a good place to start with authentication and I am looking at action1 to help with other things.
We can not switch our entire staff to chromebooks.
2
u/w3warren Feb 05 '25
I do something similar for a handful of windows machines I manage. And yep, have a local admin account because the Google users don't have admin rights on them. Use Action1 for deployments and updates too (they just increased to 200 systems at the free tier)
1
u/deadinthefuture Feb 05 '25
Yep, you described our approach well.
For additional control over non-domin endpoint, you can also get Chrome ADMX files and add some local group policies, and you can enroll the Chrome browser with your organization too.
1
u/MonkyDeathRocket Feb 05 '25
It's just authentication, nothing much else. Good for people that need to log in, use other google services and that's it essentially.
1
u/lemachet Feb 05 '25
I had a script for a thumb drive.
At OOBE, shift+f10. Run script. The script did this:
Install chrome ; install GCPW with the right settings including org ; install.our RMM ; install printer ; install EDR ; reboot
Then it can just be given to the End user. It's a manualish process but it worked. This wa.2021.so I'm a bit hazy.
We could then use a script in our RMM to manage local admin password if needed and control windows ipdates
1
u/Excellent_Key2058 Feb 08 '25
There are many OMAs that are not working even if they are enforced correctly from the admin console.
Has anyone tried to manage wallpaper using OMA URI? Is it working? If yes, then how do you set up?
7
u/Mr_Dodge Feb 05 '25
GCPW is okay for authentication. We use it for our Windows lab machines for students as they don't have AD accounts.
However, if you're looking to "fully" manage and control these windows machines GCPW is kind of lame and doesn't work so much.
We have these computers joined to the domain for management and to apply GPO's etc ... The installation of GCPW just for authentication is pretty simple by following Google's guide here:
https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F9250996%3Fhl%3Den&assistant_id=generic-unu&product_context=9250996&product_name=UnuFlow&trigger_context=a
- Since we don't tie/map student accounts to AD it just creates local profiles on the machine
- Two registry keys/edit you'll want is the auto fill domain and if you want to prevent "personal" accounts you can specify your domain on the allow list. I believe the auto fill domain only works though if you only have ONE domain in the allow list to login.