Incident Report

Summary

Beginning on 1 October 2025, Google Endpoint Management customers experienced issues enrolling new Windows devices using the native Windows Settings application or direct enrollment deeplinks. This incident started on 1 October 2025 at 00:00 US/Pacific and lasted for 22 days, 17 hours and 19 minutes, with resolution on 23 October 2025 at 17:19 US/Pacific. We sincerely apologize for any impact this disruption had on your device management workflows. We are taking measures to prevent a recurrence.

Root Cause

The root cause of this incident was a deprecated[1] browser compatibility issue. The device enrollment process initiated from the Windows Settings application relies on an embedded browser component. This component's behavior is based on the now deprecated Internet Explorer 11. Recent updates to Google's Identity servers, intended to enhance security and modernize the platform, inadvertently removed compatibility with the outdated protocols and behaviors exhibited by the Internet Explorer 11 engine. As a result, authentication requests from the Windows Settings enrollment flow could no longer be processed successfully by the updated Identity servers, causing the enrollment to fail.

[1] Deprecated browser compatibility issue: https://learn.microsoft.com/en-us/lifecycle/products/internet-explorer-11

Remediation and Prevention

The issue was detected on Tuesday, 14 October 2025, at 10:23 US/Pacific, as the impact progressively increased, prompting a detailed investigation. Google engineers traced the failures back to the incompatibility between the Google Identity servers and the enrollment process embedded within the Windows Settings application, which uses a deprecated Internet Explorer 11 component.

To remediate the issue, Google engineers developed and deployed a targeted fix to the Google Identity servers. This update restored the servers' ability to handle authentication requests originating from the enrollment flow dependent on the Internet Explorer 11 technology. The rollout of this fix was completed on 23 October 2025 at 17:19 US/Pacific, fully restoring the ability to enroll new Windows devices via the Windows Settings application and deeplinks.

Google is committed to preventing similar incidents in the future and is completing the following actions:

We are enhancing our testing procedures for Windows device enrollment flows. We are exploring improvements in monitoring to detect issues on lower-traffic enrollment pathways more rapidly.

Detailed Description of Impact

Google Endpoint Management - From 1 October 2025, 00:00 US/Pacific to 23 October 2025, 17:19 US/Pacific, customers were unable to enroll new Windows devices into Google Endpoint Management when using the built-in Windows Settings application (as described in “Enroll a device” in Windows device management) or an enrollment deeplink. The enrollment process would fail during the authentication phase due to the incompatibility.

Customers using the Google Credential Provider for Windows (GCPW) for device setup and login (as described in “Install Google Credential Provider for Windows”) were not affected by this incident and could continue to enroll and manage devices without issue. The impact was limited to the specific enrollment method relying on the Windows Settings interface.

Mini Incident Report

We apologize for the inconvenience this service disruption/outage may have caused. We would like to provide some information about this incident below. Please note, this information is based on our best knowledge at the time of posting and is subject to change as our investigation continues. If you have experienced impact outside of what is listed below, please reach out to Google Cloud Support using https://cloud.google.com/support or to Google Workspace Support using help article https://support.google.com/a/answer/1047213 .

(All Times US/Pacific)

Incident Start:01 October, 2025 00:00

Incident End:23 October, 2025 17:19

Duration:22 days, 17 hours, 19 minutes

Affected Services and Features:

Endpoint Management

Description:

Starting on 01 October 2025, Endpoint Management customers experienced the inability to enroll new Windows devices using Windows Settings app or deeplink. We detected the impact when it progressively increased on Tuesday, 2025-10-14 10:23 PDT.

From our analysis, the issue originated from a browser compatibility concern. Specifically, the Microsoft-provided Windows Settings application utilized the deprecated Internet Explorer 11, rendering it incompatible with recent modifications to the identity servers. Our engineers resolved this by deploying a fix to the Google Identity servers to restore support for these requests.

Customer Impact:

The Windows native settings application, which facilitates communication with Google Identity and Endpoint management, relies on Internet Explorer 11, a browser no longer supported by Microsoft. Device enrollment was affected due to Google Identity servers unable to fulfill requests from Internet Explorer 11.

Customers encountered issues enrolling new Windows devices in Google Endpoint management through the Windows Settings app or deeplink ¹ . However, users leveraging Google Credential Provider for Windows (GCPW) were unaffected by this problem ² .

Reference(s):

¹ Enroll a device in Windows device management

² Install Google Credential Provider for Windows

Summary

Customers were unable to enroll new Windows devices to Endpoint management using Windows Settings app or deeplink.

Description

The issue with Endpoint management for Windows enrollment has been resolved for all affected customers as of Thursday, October 23, 2025, 17:19 PDT.

From preliminary analysis, the issue was caused by a browser compatibility problem with the deprecated IE11 used by Microsoft provided Windows Settings app. Our engineers resolved this by deploying a fix to the Google Identity servers to restore support for these requests.

We thank you for your patience while we worked on resolving the issue.

Symptoms

Customers were not able to enroll new Windows devices to Endpoint management using Windows Settings app or deeplink. ( https://support.google.com/a/answer/9539504?hl=en&sjid=13524530415918932254-NC&authuser=0 )

Customers using GCPW (Google Credential Provider for Windows) were not impacted. ( https://support.google.com/a/answer/9250996?hl=en&src=supportwidget0&authuser=0 )

Workaround

None.

Summary

Customers are unable to enroll new Windows devices to Endpoint management using Windows Settings app or deeplink.

Description

Mitigation work is currently underway by our engineering team.

We do not have an ETA for mitigation at this point.

We will provide an update by Friday, 2025-10-24 12:00 PDT with current details.

Symptoms

Customers are not able to enroll new Windows devices to Endpoint management using Windows Settings app or deeplink. ( https://support.google.com/a/answer/9539504?hl=en&sjid=13524530415918932254-NC&authuser=0 )

Customers using GCPW (Google Credential Provider for Windows) are not impacted. ( https://support.google.com/a/answer/9250996?hl=en&src=supportwidget0&authuser=0 )

Workaround

None at this time.

Summary

Customers are unable to enroll new Windows devices to Endpoint management using Windows Settings app or deeplink.

Description

Mitigation work is currently underway by our engineering team.

We do not have an ETA for mitigation at this point.

We will provide an update by Thursday, 2025-10-23 17:00 PDT with current details.

Symptoms

Customers are not able to enroll new Windows devices to Endpoint management using Windows Settings app or deeplink. ( https://support.google.com/a/answer/9539504?hl=en&sjid=13524530415918932254-NC&authuser=0 )

Customers using GCPW (Google Credential Provider for Windows) are not impacted. ( https://support.google.com/a/answer/9250996?hl=en&src=supportwidget0&authuser=0 )

Workaround

None at this time.