G Suite - view Google Docs / Drive sharing across all user accounts?

[pete]

Has anyone inherited a G Suite tenancy where the sharing is a little eclectic?

 

Did you find a straightforward means of enumerating files shared outside the tenancy?

 

And then mitigating the various WTFs that appear?

 

cheers

[icemonkey]

I once ventured into this but it was a while ago!

 

There might be an easier way but at the time, this seemed to give me more control over the process!

- Go the the "Reports" Section of the admin console

- Run a "Drive Audit" report

- Filter on Visibility (or Changed Visibility) as necessary

- Export to Google Sheet and check for any files that seem strange (I filtered out my colleague as an owner as a lot of his files are linked on our website)

- Use the Document IDs with a GAM batch/csv command to change the permissions

 

I only did this for files where the visibility had been changed to "Shared Externally", I'm yet to pluck up the courage to do this for "Anyone with a link can view"!!

 

 

You can set whether sharing externally is allowed across the domain but I'm not sure whether this would update existing files or just prevent any newly created files being shared externally.

[Ditto]

I had done something to @icemonkey. The challenge I had is that when one of our staff left the school and joined another, he shared a lot of stuff with his new school domain as well as a personal Google account. He'd also shared a lot of his stuff with colleagues. I found out when I stumbled across assessment data that was viewable to our school, that was for his new school. DPO was notified and a good deal of locking systems down occurred after. It didn't take long for a few staff to grumble that they couldn't share stuff to there private accounts - some of those also do private work. I pointed them in the direction of the policy documents. Unpicking the mess so that the right documents (for both schools) had the right permissions was a complete nightmare. I was not familiar with GAM at the time, but knowing it now, it would have helped lot.

[pete]

Thanks guys, that helps. I assume if you want audit logs beyond six months it's one or more of:

 

• Give Google money for the functionality
  
• They don't exist (cos you have to increase retention before they were deleted)
  
• Use the API / GAM?
  

 

?

Edited April 24, 2020 by pete

[Ditto]

Thanks guys, that helps. I assume if you want audit logs beyond six months it's one or more of:

 

• Give us cash
  
• They don't exist (cos you have to increase retention before they were deleted)
  
• Use the API / GAM?
  

 

?

Cash won't help in this case. Retention periods could be an issue - see https://support.google.com/a/answer/7061566?hl=en. However, if you scan current file settings, you might be able to tackle the challenge that way.

 

API/GAM won't provide access to older logs, it's just more flexible and better for bulk changes. I can't recall if Vault will help - anyone? Do you have Vault turned on, and then if yes, what is the retention period?

[Ditto]

Just realised perhaps we haven't addressed the issue that can lead to the problems highlighted. See https://support.google.com/a/answer/60781?hl=en. Look at the section 'Restrict sharing outside your organisation'.

[pete]

Just realised perhaps we haven't addressed the issue that can lead to the problems highlighted. See https://support.google.com/a/answer/60781?hl=en. Look at the section 'Restrict sharing outside your organisation'.

 

Yeah, been through there and tightened up what I can. We've inherited two organisations that work together but have two separate G Suite tenancies. They're also sharing other stuff (info for parents, for example) publicly. So I have to unpick it while breaking as little as possible.

 

Both tenancies look pretty slapped together without much thought put into them. We inherited it from an MSP who inherited it from another MSP that set it up.

 

---

 

Vault is turned on, but there's no retention set.

Edited April 24, 2020 by pete