[MUSIC PLAYING]
RAVI KIRAN KUMAR: Welcome to the Google Cloud Security Showcase,
a special web series where we'll focus on security use cases
that our customers can solve with G Suite and Cloud
Identity.
My name is Ravi Kiran Kumar.
And I'm a product manager at Google Cloud.
Today, we'll be walking you through one
of the top questions we get from our customers,
how can I manage Windows 10 devices within my organization?
Your G Suite endpoint management currently
allows you to manage Android devices, iOS devices,
Chromebooks, and Jamboards.
We extended this functionality to manage desktops using
advanced Windows Management.
This feature includes two key components.
First, admins will be able to use
a simple, easy-to-use interface to manage all Windows 10
devices.
They'll be able to see the inventory,
push Windows settings, and also perform admin actions,
like remote wiping a device.
The second key component is log-in.
Your end users will be able to log into Windows devices using
G Suite credentials.
Let's jump into a quick demo.
So let's look at the Windows Management
up close on the admin console.
So here's the familiar admin console,
where you manage your G Suite or Cloud Identity.
So we'll first start with the Windows settings--
so where you can configure Windows settings
and how you push it.
And then we'll look at the device inventory and the admin
actions.
And then finally, we'll wrap it up with the audit logs.
So let's start with Windows settings.
I'm clicking on Devices section here.
And then click on Windows Settings.
So this is the place where you can set your Windows settings.
So you start with clicking on, say, Account Settings, where
you can designate whether the user should get a standard user
account or a local account.
If you already have some support accounts
and other local administrator accounts,
you can designate those.
And then you can apply these settings
at the root level or any of the OU level.
Now, let's go back and look at-- so you can also
add Windows update settings, BitLocker settings.
And there are close to 1,000 settings you
can apply using this interface.
So if you don't see a specific setting in this interface--
so you'll be able to use the custom settings feature.
For example, let's say I want to disable camera.
So I'll start adding the custom setting.
I'll say Disable Camera.
And then I'm typing in this camera here.
So you'll be able to see help information for each of these.
The setting that I'm looking at is the Allow Camera setting.
And if I wanted to disable, I'm clicking on 0.
So you must be wondering where you can get this information
on this OMA-URI and the value.
We have documented the common custom settings
that most people use in the Help Center.
So when you expand one of these, you'll
be able to see the OMA-URI and the value.
So we have a number of common settings here.
But if you want to look at the entire list of settings--
so we do have links to Microsoft documentation, which
provides more information.
So once you apply this setting, you'll
be able to apply to the root OU or you
can select one or more sub-OUs.
And then you can apply.
So this is how you set your Windows settings.
Now let's go back and look at the device inventory.
So I'm back to Device Management page.
I'm clicking on Endpoints.
And endpoints-- so you'll be able to see all your endpoints,
whether it's mobile devices, desktops.
So I want to specifically look at the Windows devices that
are managed using enhanced desktop security for Windows.
So I'm clicking on Management Type.
And I'm clicking on Enhance Desktop Security.
If you're one of those companies who
don't use Windows Management and who are using only GCPW,
you'll be able to see all of your devices
that have GCPW by clicking on this checkbox.
I'm clicking on Apply.
And I'm opening this device here.
So you'll be able to see all the device information, like device
ID, serial number, hostname, and a bunch of other information
about this device.
You'll also be able to see when did the device
sync with the server so that you can
see when the device received all those Windows settings
the last time.
And then you can also see the user and the owner information
here.
And from an admin actions perspective--
so you can do a bunch of admin actions here.
So you can block this device so that you
can't access G Suite or other resources using this device.
You can sign out the user, wipe the device.
You can unenroll the device.
And then finally, you'll be able to look
at the audit log associated with this particular device.
So now you'll be able to see the entire audit log.
I have a filter on this particular device ID here.
You'll be able to see all the settings that
were pushed to this particular device, the time
when it was pushed, and also the error codes
or whether it was success or failure.
All that information is available here.
If you want to look at the device--
audit logs for all your devices, again, you
can simply go to your Reporting section and click on Devices.
This is where you'll be able to see all that information here.
The Google Credential Provider for Windows
allows users to sign into Windows devices using
Google credentials.
It also provides an easy way for administrators
to enroll devices for management and control of user accounts.
Now let's take a look at it in action.
So I have a Windows 10 device with GCPW installed.
So the next time when the user reboots their machine,
this is how it looks when they first log in.
So the log-in screen looks familiar.
The only minor change the user will see
is, instead of seeing a password box below the username,
you will be able to see a text that says "Sign
in using the work account."
So now let's start the log-in process by clicking there.
The user starts logging into Google
and then answers two-step verification challenge there.
And now we're logging automatically
into the Windows behind the scenes.
And during this time, we're also enrolling
this particular device in Windows Management.
If you have disabled the enrollment
to operate GCPW in a standalone mode,
the enrollment will be skipped.
And during the first log-in process,
we are also creating a device entry
so that admin can see this device in their inventory.
So now once the user logs in, the user
can open their browser.
And in this case, I'm accessing the Gmail.
You can access any Google resource
without entering Google credentials.
And this is another single sign-on solution
that is tied to G Suite and Cloud Identity.
So you're able to access those third-party applications
with single sign-on experience.
Now let's see how it looks when you try to access a G Suite
desktop-based application.
So here, we're trying to access Drive File Stream.
The first time when you access Drive File Stream,
it asks for those OAuth grants.
And from the subsequent accesses,
you can just directly access that Drive File Stream, again,
without entering the Google password or the username.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]