Configuring Google Authenticator for Active Directory password resets and logins
Google Authenticator is an authentication method developed by Google that uses a time-based one-time-passcode (TOTP) in order to verify users' identities. It is often used as one of the multi-factor authentication (MFA) methods along with others in order to secure the login process into a service. Authentication using this method requires the Google Authenticator app. After the users have provided valid login credentials, the service asks them for the 6-digit TOTP from the app. The users then have to run the app to obtain the TOTP and enter it in the service, and verify their identity.
Empowering Active Directory domain users with self-service password reset can benefit an organization in more ways than one.
- Users need not wait for admin intervention and can have seamless access to their machines.
- The help-desk admin will not be tasked with hundreds of password reset requests and can instead attend to other crucial tasks.
However, providing users with the ability to reset their passwords can end up risky if proper security measures are not put in place. With users not having to provide any old credentials, it is important to verify their identities before they can reset their passwords. Using an MFA method like Google Authenticator is a fail-safe way to verify a user's identity before permitting them to proceed with a password reset.
ADSelfService Plus, an Active Directory self-service password management and single sign-on solution, offers a one-stop solution to self-service password reset secured by MFA. The solution supports over 18 methods of MFA including Google Authenticator, security questions and answers, and YubiKey Authenticator to verify users' identities during:
- Windows, macOS, and Linux logins.
- Active Directory self-service password reset or account unlock actions via the ADSelfService portal, ADSelfService Plus mobile app, and native Windows/macOS/Linux login screen.
- Enterprise application logins through single sign-on (SSO).
- Self-update of Active Directory profile information, subscription to mail groups, and employee search using ADSelfService Plus.
Step to enable Google Authentication for MFA in ADSelfService Plus:
- Download and install ADSelfService Plus.
- Configure your Active Directory domains.
- Navigate to Configuration → Self-Service → Multi-factor Authentication → Authenticators Setup.
- From the Choose the Policy drop-down, select a policy.
Note: ADSelfService Plus allows you to create OU and group-based policies. To create a policy, go to Configuration → Self-Service → Policy Configuration → Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature. Finally, click Save Policy. Only users belonging to OUs and groups in the policy can make use of the self-service feature(s) selected.
- Click Google Authenticator section.
Click the Enable Google Authenticator button.
Enabling Google Authenticator for Active Directory password resets
- Go to Configuration → Self-Service → Multi-factor Authentication → MFA/TFA Settings. In the MFA for Reset/Unlock section, enter the number of authentication factors to be enforced, and select Google Authenticator along with the other authentication techniques to be used.
- Click Save Settings.
Enabling Google Authenticator for Active Directory domain logins
- Go to Configuration → Self-Service → Multi-factor Authentication → MFA for Endpoints.
- Select a policy from the Choose the Policy drop-down. This will determine which authentication methods are enabled for which sets of users.
Note: ADSelfService Plus allows you to create OU and group-based policies. To create a policy, go to Configuration → Self-Service → Policy Configuration → Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature. Finally, click Save Policy.
- In the MFA for Machine Login section, check the Enable _ authentication factors box and select the Google Authenticator from the drop-down.
- Click Save Settings.
To enable MFA for Active Directory domain logins:
- The ADSelfService Plus login agent must be installed on client machines. Click here for steps on login agent installation.
- SSL must be enabled: Log in to the ADSelfService Plus web console with admin credentials. Navigate to the Admin tab → Product Settings → Connection. Select the ADSelfService Plus Port [https] option.
Simplify password management with ADSelfService Plus.
Your download is in progress and it will be completed in just a few seconds!
If you face any issues, download manually here
Self-service password management and single sign-on solution
ManageEngine ADSelfService Plus is an integrated self-service password management and single sign-on solution for Active Directory and cloud apps. Ensure endpoint security with stringent authentication controls including biometrics and advanced password policy controls.
- Related Products