Replacing Active Directory with Google authentication - JumpCloud?

[stoltzfusm]

We are gradually moving as many of our locally hosted services as possible to the cloud.  I've already migrated file and print services to cloud-based solutions, and all of our databases and ERP solutions are cloud based at this point.  The main thing that's left is Active Directory.  We're a single-campus K-12 private school with a fairly simple AD schema, and we're also a Google Workspace for Education school.  I would love to be able to completely eliminate AD and use Google credentials to authenticate and manage our computer accounts (we have a combination of Windows computers and Chromebooks - no Macs).  Does anyone have any experience with JumpCloud, or another solution that would accomplish this goal?

[CalebSpring]

We use JumpCloud right now but Google also has a similar feature called End Point Management which is part of Workspace. We like JumpCloud but plan to switch to Googles solution only because why pay for two services when you don't have too. 

https://support.google.com/a/answer/1734200?hl=en 

[BC-Evan]

You should deploy GCPW - Google Credential Provider for Windows. It lets you log into Windows with Google accounts. Chromebooks are already set.

[rkkumar]

Here's a short Youtube video if you want to see it in action. 

[jhaff · Accepted solution]

+1 for GCPW, basic authentication works on the k-12 fundamental (free) version of google workspace for edu.  if you have a paid version of google workspace, you get more functionality like settings control, enhanced security, etc.  

you can most likely utilize google secure ldap for auth into other services you are using.  you can see their article here, it lists a number of authentication integrations using secure LDAP. 

i'm in the same boat, doing everything i can to eliminate AD and our legacy on-prem environment.  we looked into jumpcloud and azure, but we already have a MDM for our mac fleet, JAMF, and didn't really want to buy into another IdP since google is so close to having most of what we need.

[rkkumar]

We recently did a webinar on Youtube Live focusing on reducing AD dependence. It includes an overview of various identity components that can help and a high level play book. Hope it helps

[josephbears]

We are currently on GCPW but we previously used JumpCloud for years.  One of the biggest issues with GCPW is password syncing to other windows machines.  If you have shared drives on other machines and your password is changed by either expiration or by the end user needing a password reset this doesnt propagate to the other windows machines.  IT has to get involved and manually update the passwords on the other computers.  If you change your Jumpcloud password all other machines that have the agent installed get the updated password.   We have an internal web based application that use Windows authentication.  GCPW causes major issues in this regard because the passwords dont propagate.  I can see the promise of GCPW but some basic functionality you would expect is missing.

[rkkumar]

Are you using GCPW on other Windows machines? If so, GCPW should propagate password changes done within Google to those machines during Windows login. 

[josephbears]

Yup and we consistently have to use the forgot password mechanism which then wipes the local profile. 

[josephbears]

Also some machines are Windows server. Is there plans to be able to install GCPW on Windows server?

[josephbears]

And where it’s only syncing on Windows login then that means if you have an SMB share hanging off another machine it won’t get the updated password. For these shares users never directly login to the machine.