Problems completing set up of new google user due to enforcement of 2FA...

[reggie]

Hi,

My organization has the 2FA enforced. There is a new user that has 2FA turned off, and it is preventing them from completing their initial sign in. From my admin console, i cannot turn it on for them. Is there a workaround to get them set up?

[ajojose33333344 · Accepted solution]

Hi @reggie ,

**How to resolve the issue now:

a) move the user to an ou where 2sv enforcement is disabled.

or

b) Generate a backup code for this user:

1. In the Admin console, go to Menu > Directory>Users.
2. Click the user you want in the list. 
   You see summary information about that user.Click Security.
3. Click 2-step verification.
   verification is currently enforced for your organization.
4. Click Get Backup Verification Codes.
5. Copy one of the verification codes.
6. Send the backup code to the user in an IM or text message.
   The user can sign in to their account using a password and the backup code.
7. Now they can enroll to 2sv methods and start using

[reggie]

Thank You! that did the trick

[ajojose33333344]

Glad to hear that!!

[dlandagriffin]

Help 

[ajojose33333344]

** How to prevent it from happening in the future:

1. In the Admin console, go to Menu > Security>Authentication>2-step verification.
2. To give new employees time to enroll before enforcement applies to their accounts, for the New user enrollment period, select a timeframe from 1 day to 6 months.

During this period, users can sign in with just their passwords and they can complete the 2sv enrollment within the time that you specified.

[sdcruz]

Hi there,

I was going through pretty much the same thing --- albeit for most of an organization's  users --- mainly coz the director abruptly decided to enforce 2FA. I tried to to explain that users might get locked out if it wasn't done gradually & that they'd have to be notified, but he was insistent....

Sure enough, soon after I enforced it, at least 2 colleagues got locked out. Fortunately, I'd enrolled my admin account in 2FA a long time back, so addressing the issue just meant disabling the 2FA enforcement again. 

The director then asked me to have Google Support confirm that the 2FA enrollment can only  be done by end-users, & not by admins.  So I created a support ticket, got support to confirm it, & now here I am... 😄

If you guys happen to find out of any means to 'apply' the enrollment onto users so that they needn't be notified / relocated into temporary groups, please let me know. Thanks.

Cheers.

[ajojose33333344]

@sdcruz  Hi there,

2 step verification is something that should be done from the user end because it's the way  the user defines "his" 2nd verification method and it's not the admin's piece of cake 😅

the admin can only set permission like whether they can enable it or not or whether it should be mandatorily enabled(enforcement.)

Here is the link that supports the statement

[DavidPooley]

Hi, does anyone know if the new user enrollment period starts from the date a new account is created, or the date the user first signs into their account?

Thanks.

[ajojose33333344]

@DavidPooley I guess it should be counting from the creation date,anyways i have put it into test will confirm with you in a day.

[Afuerst1]

Hello I was just checking in to see if you were able to come to a conclusion on when the enrollment period starts. Is it account creation or first sign-in, were you able to test? 

[KAM]

@Afuerst1 it's from account creation not first login.  This KB might help as well if you are trying to minimize disruption: https://apps.google.com/supportwidget/articlehome?hl=en -KAM

[Afuerst1]

Thanks for the info. The weird part is I have an account that was created well outside of the grace period (long time ago), but when it was moved into an OU that enforced 2sv for the first time the grace period went into effect. 

I am noticing accounts that stay in an OU don't have the grace period/enrollment trigger at all when the OU enforces 2sv.

I think it has something to do with the date the account was added to the OU it resides in? I would love to figure out a method to reset that grace period for accounts and setting up 2sv. We have accounts that stay in our system for long times, but need 2sv turned on / off for various processes.

Any info or tips are greatly appreciated!!  Thanks again