G Suite: Global email purge and report if user opened.

[Garacesh]

After an instance of something being accidentally sent to a pupil mailing list this morning (and the subsequent faff that followed purging the emails) I've spent a bit of time whipping up a script that should do all this for us.

This script does require PSGSuite.

 

tl;dr it hunts through all active users' inboxes for emails matching the specified RFC822 Message ID, if it finds one it performs the lookup again, this time checking if the email has been opened. If it has, it prints out a warning. Then (regardless of opened or not) it deletes the email.

 

Simply find the sent email in Vault, click the blue 'Original' link, and find the Message-ID (it's usually just below From: and Date:, and should be a full email address, e.g. [email protected]), and feed that value including the domain.gtld into the $RFC822 variable, then go!

Import-Module PSGSuite
$RFC822 = "[b]Your Message ID goes here[/b]"
ForEach ($User in (Get-GSUser -Filter "isSuspended -eq '$false'")) {
   ForEach ($Email in (Get-GSGmailMessageList -User $User.User -rfc822msgid $RFC822)) {
       If (((Get-GSGmailMessageList -User $User.User -Filter "is:read","rfc822msgid:$RFC822").count) -gt 0) {
           Write-Warning ("Email marked as Read for user " + $User.User + ".")
       }
       Remove-GSGmailMessage -user $User.User -id $Email.Id -Method Delete -Confirm:$false
       Write-Host ("Removed email ID " + $Email.Id + " from user " + $User.User + ".")
   } 
}

 

One slight caveat: It also deletes the email from the sentbox of the person, but I can live with that.

[caffrey]

Nice, haven't seen the PS thing before but just to add you can do this with GAM also :-

 

gam all users delete messages query rfc822msgid:

 

If the result is okay then doit

 

 

gam all users delete messages query rfc822msgid: doit

 

For individuals

 

gam user [useremail] delete messages query rfc822msgid: 

 

doit if it's okay

[Garacesh]

Usually I would use GAM, and have done in the past, but it just wasn't working for me this morning. Kept failing. No idea why. I finally managed to make it play ball just by keep repeating the command over-and-over until it succeeded, but that's hardly the best method.

(Error was EOF occurred in violation of protocol (_ssl.c:1123), if anybody can make sense of that)

 

Only results I found was to make a nocache.txt in the same folder as the GAM exe but that didn't work, and to lower the maximum concurrent threads, which it would still fail even on 1.

Edited September 20, 2021 by Garacesh

[jthompson]

I use a one-line GAM command to perform deletions like this (or more targeted variations of), but that doesn't do any of the reporting about opened copies that yours does. However, after deletion the messages are still visible in Vault, even though they've been completed removed from the user perspective, and you'll still be able to see whether they were ever opened or not.

 

gam all users delete messages query rfc822msgid:[email protected] doit

Without the 'doit' GAM will just perform a simulation run.

 

In Vault, the search term

rfc822msgid:[email protected] AND is:read

will list the copies that were ever opened.

[SpaceInvader83]

If you are licensed the investigation tool can do all this..

 

https://support.google.com/a/answer/7581662?hl=en

[Garacesh]

the investigation tool

 

Yeah but isn't that like £4 a user?

I remember them showing it off at, I think it was EDIT Salisbury? And it did seem incredibly useful and impressive in scope, but the cost would be too great here.

[paulkerton]

Yeah but isn't that like £4 a user?

 

It's £3.20 per student per year if you do your whole school. 1 staff license with every 4 students ones.

So if you've got 1500 students its £400 a month and you get all the administration tools, unlimited plagarism checking, unlimited Google Meet recording (which goes away after Autumn Term btw)

Edited September 21, 2021 by paulkerton

[SpaceInvader83]

Yeah but isn't that like £4 a user?

I remember them showing it off at, I think it was EDIT Salisbury? And it did seem incredibly useful and impressive in scope, but the cost would be too great here.

Good question, we already have Enterprise for Education licences (Legacy) for other functionality but I think it comes with the new Education Standard or Plus editions, I must admit I have always used GAM for mass deletes and have only just recently found this was even a thing.

[jthompson]

Usually I would use GAM, and have done in the past, but it just wasn't working for me this morning. Kept failing. No idea why. I finally managed to make it play ball just by keep repeating the command over-and-over until it succeeded, but that's hardly the best method.

(Error was EOF occurred in violation of protocol (_ssl.c:1123), if anybody can make sense of that)

 

Only results I found was to make a nocache.txt in the same folder as the GAM exe but that didn't work, and to lower the maximum concurrent threads, which it would still fail even on 1.

 

Looks like a python error, so maybe being tripped by something in your environment if you're running GAM on a school machine. If your PowerShell stuff worked fine, that would suggest a python-specific cause. I can recommend having GAM installed on Google Cloud Shell if you haven't already, even just as a fallback option. One would imagine it'll be less likely to stumble into TLS problems with the Google APIs.

[caffrey]

+1 on the Google cloud shell, more secure that way too