Problem
Environment
- Windows devices
- Active Directory
- Google Credential Provider for Windows
Solution
GCPW associates a user’s Google Account with an existing local or AD Windows profile based on a custom attribute you add in Google Directory. The custom attribute specifies the user’s username for their local or AD Windows profile.
When the user signs in to the device for the first time after you install GCPW, GCPW checks the user's information in the Directory for Windows usernames. GCPW gets the user's Windows username from the Directory and looks for the matching profile or AD username on the device.
Note: For AD-joined devices, if the user doesn’t have an AD-backed Windows profile on the device already (so they have to click Other user to sign in), the device must be connected to AD for the user’s first sign-in.
- If GCPW finds a matching Windows profile or AD username, GCPW associates the Google Account with the Windows profile and synchronizes passwords.
- If the Directory doesn't contain any Windows usernames for the user, or if GCPW doesn't find a match, then a new Windows profile is created on the device and associated with the Google Account.
- For AD domain-joined devices, if the AD username isn’t valid, then GCPW may return an error. If the custom attribute isn’t set for the Google Account, GCPW creates a Windows profile or returns an error, depending on the type of account the user clicked to sign in.
To associate existing Windows users with Google Workspace accounts, you can follow the steps in this Google Help Center article.
If admin has configured it mistakenly at least once, editing to correct value will not solve the problem, admin will need to remove custom attributes and association and start over.