[MUSIC PLAYING]
SPEAKER: When someone signs in to a Google Workspace account,
we don't just check the username and password.
We look at several factors before letting
that person have access to the account and its data.
But before we get started, let's make
sure you're watching the right YouTube video.
This video is for administrators who
manage Google Workspace for a business or a school.
If you're having trouble signing in to your personal Google
account, stop watching this video
and take a look at this help article.
Now if you're still watching this video,
we'll assume you're a Google Workspace
administrator who needs to help unblock someone right now.
Before you can help them, you need
to understand how we keep your organization's data safe.
The first method we use to secure your users' accounts
is a password.
If you have a user who's forgotten their password,
you can reset it.
You as an admin also might need to do this if, for example, you
need to retrieve files from a former employee's account.
Sign in to your Admin Console and click Manage
on the Users pane.
Click the user's account and click Reset Password.
You can enter a password that you will share with your user
or you can let Google generate a password.
Either way, send the password to your user,
and we'll ask them to create a new password once they log in.
Another way we keep your organization secure
is by presenting users with login challenges.
We do this when we detect unusual activity,
such as a user signing in from a geographic location
far from their home.
If the prompt they see says Verify It's You,
you can quickly disable login challenges
and let the user sign in with just a password.
Before we show you how, let's pause for a warning.
Remember that you're about to remove almost all security
protections on your user's account.
We recommend you use a video conference
to confirm their identity and then
ask them to log into their account as soon as possible.
OK.
Back to the video.
Sign in to your Admin Console and click Manage
on the Users pane.
Click the user who needs help and open the Security pane.
Click the pencil icon next to Login Challenge
and then click the button to turn off login challenges
and other security prompts for 10 minutes.
Once the user signs in, we encourage
you to use the Admin Console to add a mobile phone and recovery
email to their Google Workspace account.
That way they'll be able to sign in on their own
the next time they receive a login challenge.
The next level of protection we offer is two-step verification.
We strongly recommend you turn on two-step verification
for your entire organization.
Users experiencing trouble with the two-step verification
prompt have already enabled this extra level of security
and will receive a login challenge every time
they sign in to their Google Workspace account
from a new device.
If a user can't get past two-step verification,
the easiest way to help this person get back to work
is to provide them with backup codes.
Sign in to your Admin Console and click Manage
on the Users pane.
Click the user who needs help and open the security pane.
Click 2-step verification and then click
the button to get backup verification codes.
Send the codes to the user and ask
them to follow the prompts to enter
one of their eight-digit backup codes.
Another way we safeguard your user accounts
from malicious attacks is to provide an additional challenge
whenever someone performs sensitive actions,
such as changing the password, changing
the name on their account, or exporting account data.
Users performing sensitive actions
will receive a login challenge.
If the user fails verification, we will not
allow them to do the action.
They can still use their account,
but you will get a notification of failed sensitive actions
so you can investigate if the user intended to do them.
If one of your users gets blocked from doing an action,
you can help them by temporarily disabling these login
challenges as we showed you earlier in this video.
And finally, Google's strongest level of protection
is the Advanced Protection Program.
Executives and other high-profile users
in your organization might be specifically targeted
by criminals trying to take over their Google accounts.
If you enable advanced protection for a user,
they'll be required to insert a hardware security
key every time they sign in to their Google account.
That about wraps things up.
But before we say goodbye, here's a reminder.
Google Workspace is designed to keep your organization's data
safe from malicious attacks.
But criminals are always looking for new ways
to compromise accounts, especially admin accounts.
Remember that passwords often aren't
enough to keep your account secure.
We encourage you to turn on two-step verification
for yourself, your fellow admins,
and your entire organization.
This help article will show you how.
Thanks for watching.