How to Configure Google Credential Provider for Windows (GCPW)

The Disconnected Endpoint Problem

When an enterprise completely eliminates on-premise Active Directory and goes 100% cloud-native with Google Workspace, they face a glaring issue with Windows 10 and 11 laptops: How does the employee log into the physical laptop itself?

Without Active Directory, the Windows laptop does not know the user exists. Historically, IT would have to create a local, unmanaged user account (like LocalAdmin) on the laptop. This is disastrous for security. The user has a separate password for the laptop and a separate password for their Gmail, and if the employee is terminated, disabling their Google account does not lock them out of the physical laptop.

Google solved this by engineering the Google Credential Provider for Windows (GCPW). GCPW is a piece of software you install on the Windows machine. It fundamentally alters the Windows login screen. Instead of seeing the standard local account avatar, the user is presented with a button that says “Sign in with Google.” When they click it, the native Google OAuth window appears directly on the Windows lock screen. They enter their Gmail address, their Google password, and their 2-Step Verification code. GCPW verifies the token with the cloud, creates a local Windows profile on the fly, and logs the user directly into the desktop, syncing their password perfectly.

Step 1: Enabling GCPW in the Admin Console

Before installing the software on the laptops, you must authorize your Google Workspace tenant to accept GCPW authentication requests.

1. Log into the Google Workspace Admin Console.
2. Navigate to Devices > Mobile > Endpoints > Settings > Windows settings.
3. Click on Google Credential Provider for Windows (GCPW) setup.
4. Select your root Organizational Unit (or a specific OU for testing).
5. Click the checkbox for Permit GCPW and click Save.
6. Expand the Offline access section. Set the policy to require online authentication every 30 days. (This ensures that if a user is terminated, their cached offline credentials will eventually expire, permanently locking the laptop).

Step 2: Defining the Allowed Domains

You must strictly define which Google domains are allowed to log into the physical laptops to prevent an employee from logging in with their personal @gmail.com account.

1. Under the same Windows Settings menu, locate the Allowed domains setting.
2. Enter your corporate domain (e.g., corp.com).
3. Click Save.

Step 3: Downloading and Installing GCPW

You must now install the GCPW agent on the physical Windows 10/11 laptop.

1. In the Admin Console (Devices > Mobile > Endpoints > Settings > Windows settings > GCPW setup), click the link to Download GCPW.
2. Download the 64-bit installer (gcpwstandaloneenterprise64.exe).
3. Transfer this installer to the target Windows laptop.
4. Run the installer with Administrator privileges. (It installs silently and rapidly in the background).

Step 4: Registry Configuration (The Secret Token)

The laptop now has the software, but it doesn’t know which corporate tenant it belongs to. You must bind the laptop to your specific Google Workspace instance using an enrollment token.

1. In the Admin Console, back on the GCPW setup screen, click Generate a new token and copy the string.
2. On the Windows laptop, open Registry Editor (regedit.exe).
3. Navigate to HKEY_LOCAL_MACHINE\Software\Google\GCPW.
4. Create a new String Value (REG_SZ) named CloudManagementEnrollmentToken.
5. Paste the token string into the Value data field.

The Login Experience

Restart the Windows laptop.

When the laptop boots to the lock screen, the standard local accounts will be pushed aside, and the primary login option will be the Google multi-colored ‘G’ logo. The employee clicks the logo, authenticates against Google’s live servers (passing any required 2FA or Context-Aware Access policies), and drops seamlessly into a fully managed Windows desktop. The physical endpoint is now completely tethered to the cloud identity.