Set token to manage GCPW from the Admin console

Supported editions for this feature: Frontline Starter and Frontline Standard; Business Starter, Business Standard, and Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, Education Plus, and Endpoint Education Upgrade; Essentials, Enterprise Essentials, and Enterprise Essentials Plus; G Suite Basic and G Suite Business; Cloud Identity Free and Cloud Identity Premium. Compare your edition

With the release of Google Credential Provider for Windows (GCPW) version 87.0.4280.88, you can manage GCPW settings from the Admin console instead of editing the registry settings on each Windows device. To use this feature, the GCPW client on the device provides an organization-specific token to Google when the user first signs in. The new GCPW client available for download in the Admin Console has your organization’s token embedded in the installer.

Who's affected

If you're just getting started with GCPW, you don't need to do anything. The GCPW installation file you downloaded from the Admin console includes the token.

If you don't want to manage GCPW settings in the Admin console because you want to use registry settings, you don't need to do anything.

If you already set up GCPW before version 87.0.4280.88 on a device, the user can still sign in and the GCPW registry settings you set still apply. However, to edit permitted domains from the Admin console, you must set the token value in the registry file. You don’t have to remove the existing registry settings because the Admin console settings override them.

Set the GCPW token

You can update the token on devices in the following ways. We recommend you reinstall GCPW or run the registry file to avoid potential errors in the device's registry settings.

Reinstall GCPW with a client that has the new token

If you haven't already, download a new GCPW installation file:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsWindows.
3. Click Google Credential Provider for Windows (GCPW) setupDownload GCPW.
4. Download the 64-bit or 32-bit GCPW installation file and distribute it to devices.

To update the token, on the device, run the installer. You can double-click the installation file or run the file from Command Prompt:

1. Open the Command Prompt.
2. To install the 64-bit client, run gcpwstandaloneenterprise64.exe as administrator. To install the 32-bit client, run gcpwstandaloneenterprise.exe as administrator.

Run a registry file on the device

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsWindows.
3. Click Google Credential Provider for Windows (GCPW) setupDownload GCPW.
4. Click registry file.
5. Distribute the registry file to Windows devices.
6. On the Windows device, double-click the registry file to run it. The token value in the registry is updated.
7. Restart the device.

Add a token to the registry manually

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsWindows.
3. Click Google Credential Provider for Windows setupDownload GCPW.
4. In the box with the token, click Copy.
5. Save the token somewhere convenient that you can access from other devices.
6. On the Windows device, back up the current registry key then import the new one:
   1. From the Windows Start menu, click Run.
   2. In the Run box, enter regedit.
   3. In Registry Editor, go to HKEY_LOCAL_MACHINE\Software\Policies.
   4. Right-click Policies  and click NewKey to create a folder.
   5. Name the folder Google.
   6. Right-click Google and click NewKey to create a folder.
   7. Name the folder CloudManagement.
   8. Right-click the CloudManagement folder and click NewString Value.
   9. For the name, enter EnrollmentToken. 
   10. Double-click the name and, in the Value data box, paste the token.
   11. Click OK.
7. Close Registry Editor and restart the device.