Google user login verification failed?

[Marlon Yu]

Hi everyone,

 

Have any of you encountered an issue with Google where users (so far only affecting 4 Chromebook users) who’ve recently changed their passwords are being flagged by Google as suspicious and wants to verify them, however, verification fails.

 

They are greeted by this message with a button to click to “Recover account”

 

 

If you click on Recover account, it asks for the email address …

 

 

But then it says “Contact your domain admin for help”

 

 

 

 

When you click on the “Learn more”, it brings you to a page that tells the user that they can’t recover the password because we have restricted password changes and to contact the admin. Yes, we have restricted password changes because we have a different tool that we use which talks to AD and syncs the changes everywhere else (for Google we use GSPS).

 

 

 

We have a ticket with Google Support but all their suggestions are not working (remove login challenge, reset password manually for each student, reset sign in cookies, specify a recovery email, submit a form to the admin recovery page). So far we’ve only had 4 students all of whom are using Chromebooks; those who’ve reset their passwords but are using Windows or Macs are logging in fine on their browser. Only the CBs won’t allow them to log into the device.

 

 

Marlon

 

*** RANGITOTO COLLEGE EMAIL DISCLAIMER ***

The contents of this email and any attachments are confidential and may be legally privileged. If you are not the intended recipient please advise the sender immediately and delete the email and attachments. Any use, dissemination, reproduction or distribution of this email and any attachments by anyone other than the intended recipient is prohibited.

*** RANGITOTO COLLEGE EMAIL DISCLAIMER ***

[Ben Durham]

I had the same issue at the end of last term with a couple users. Although disabling login challenge resolved the issue for me 

Regards

Ben

[Marlon Yu]

Thanks Ben. Had another round of chat with Google Support this morning and tried that but it still won’t work. They’ve asked for a HAR file to escalate further. Fingers crossed they’ll find an easy fix soon.

 

Marlon

 

From: techies-f...@googlegroups.com <techies-f...@googlegroups.com> On Behalf Of Ben Durham
Sent: Tuesday, July 23, 2024 9:39 AM
To: Techies for schools <techies-f...@googlegroups.com>
Subject: [techies-for-schools] Re: Google user login verification failed?

 

CAUTION: This email originated from outside of Rangitoto College. Be careful about clicking on links or opening attachments. If in doubt, ask IT.

 

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/3dc3b4b3-dd9c-429f-98a5-49b56f3fe9ccn%40googlegroups.com.

[Steve Smith]

Hi Marlon,

Can you please send me the support ticket number so I can keep an eye on it for you ?

For these users can you see if they have the ability to recover their password switched on or off in their admin console settings

Thanks

Steve

[Marlon Yu]

Hi Steve,

 

Thanks. I’ll dig up the tickets.

 

No, we don’t allow them to recover their passwords via Google directly as we have a tool that does the password changes across all platforms. So password changes to Google are done via Google’s GSPS.

 

Marlon

From: 'Steve Smith' via Techies for schools <techies-f...@googlegroups.com>
Sent: Wednesday, July 24, 2024 8:52 AM
To: Techies for schools <techies-f...@googlegroups.com>
Subject: [techies-for-schools] Re: Google user login verification failed?

 

CAUTION: This email originated from outside of Rangitoto College. Be careful about clicking on links or opening attachments. If in doubt, ask IT.

 

Hi Marlon,

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/8e23c90f-4c15-4f4c-8e85-a0fa8185817dn%40googlegroups.com.

[Marlon Yu]

Google Support told us we had no other choice but to enter a backup email or “use the backup codes” because they “can’t turn off verification”. That made something click in my head and checked these problematic students’ accounts and there it was: they had enrolled in MFA but have no backup email or phone listed!

 

Probably not a problem for most normally, but since we have a 3^rd party tool and have opted to disable password recovery thru Google, there is no way for them to enter backup codes even if they have it because Google won’t show them that recovery page anymore.

 

Beware of this if you’re encouraging MFA use and you have password recovery turned off (for whatever reason).

 

Marlon

[Steve Smith]

Hi Marlon,

This is great info, thanks very much. Good points about password recovery.

For students we are not recommending MFA but for staff we suggest it is allowed if they want but not enforced (as per the MoE recommendations) 

We recommend for admins that have access to the admin console that 2FA is enforced for safety.

Have a great friday.

Steve

You received this message because you are subscribed to a topic in the Google Groups "Techies for schools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/techies-for-schools/lVsXN9qCKWQ/unsubscribe.
To unsubscribe from this group and all its topics, send an email to techies-for-sch...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/SY8PR01MB899729E54D7972806DEAB4D0B8AB2%40SY8PR01MB8997.ausprd01.prod.outlook.com.