GSuite bulk delete of leavers...

[Koldov]

Looking for the easiest way to accomplish this for a non-technical member of staff...

 

Before lockdown I was asked to set up GSuite for the school (I had already done the technical parts in preperation and had the domain sorted and teachers added), I also prepped instructions for bulk adding the children via a .csv upload.

 

Then I left them to it and they created the Classroom aspect of it and moved them into Year groups and Classes.

 

The only other thing they needed was apps on the iPads which I did through our Meraki from home.

 

Now a teacher has come to me and asked how to delete all the users... She doesn't understand why they are still there as she has 'deleted all the 'classes' in Google Classroom'...

 

So now I need to come up with a way of deleting hundreds of users in bulk (I'm guessing from the Google Admin portal under the OU I created for 'STUDENTS') but there is no way to filter them as they do not have any other additional info in their account such as year group or classes!

 

Edit: I did ask them in my instructions to add further OUs for Year groups but it was ignored...

Edited September 10, 2020 by Koldov

[dmj]

I did this last week because we were getting low on licenses.

Our domain is synced via GCDS. Users who are not present in AD are suspended from gsuite and not deleted.

The script I have relies on gam, and deletes users who's accounts are suspended and have not accessed them in 365 days. The first part of the script creates the csv. Presumably you won't need to do that part if you already have the csv. This is probably the easiest way, because it required zero intervention from your staff - they just need to upload the scv somewhere and the script runs as a cron. .

 

#!/bin/bash
export GAM_CSV_ROW_FILTER='{"lastLoginTime": "date<-365d"}'
gam print users query "isSuspended=True" lastlogintime |awk -F ',' '{print $1 }' >/tmp/userlist.csv
gam/gam csv /tmp/userlist.csv gam delete user ~primaryEmail

[Ditto]

I did this last week because we were getting low on licenses.

Our domain is synced via GCDS. Users who are not present in AD are suspended from gsuite and not deleted.

The script I have relies on gam, and deletes users who's accounts are suspended and have not accessed them in 365 days. The first part of the script creates the csv. Presumably you won't need to do that part if you already have the csv. This is probably the easiest way, because it required zero intervention from your staff - they just need to upload the scv somewhere and the script runs as a cron. .

 

#!/bin/bash
export GAM_CSV_ROW_FILTER='{"lastLoginTime": "date<-365d"}'
gam print users query "isSuspended=True" lastlogintime |awk -F ',' '{print $1 }' >/tmp/userlist.csv
gam/gam csv /tmp/userlist.csv gam delete user ~primaryEmail

 

Out of interest, did you take copies of student files before deletion. We had a pupil ask for their files after 6 months of leaving. Fortunately they were still in suspended state, os we coul oblige. We also had a pupil return after over a year away. At the time we had an excess of licenses, so every leaver was still suspended. I had asked SLT to advise on a retention policy as I knew this was not good practice long term, but I never got to implement anything before moving on.

[dmj]

Out of interest, did you take copies of student files before deletion. We had a pupil ask for their files after 6 months of leaving. Fortunately they were still in suspended state, os we coul oblige. We also had a pupil return after over a year away. At the time we had an excess of licenses, so every leaver was still suspended. I had asked SLT to advise on a retention policy as I knew this was not good practice long term, but I never got to implement anything before moving on.

 

No, the script only deletes users whos accounts are suspended and have not been accessed for 12 months. It would be straightforward to increase that timeout to a value that suites.

Ideally, with Google we could just do accounts for life. But we've not got around to that yet.

[caffrey]

For suspended users I remove them from the global address list too, with :-

 

gam print users query "isSuspended=True" > suspended.csv

gam csv suspended.csv gam update user ~primaryEmail gal Off

 

Keeps the GAL clean.

 

Biggest issue for me with suspended accounts was students coming in with the same name as a suspended user, but I've remedied that now with unique usernames

[Koldov]

Looking for the easiest way to accomplish this for a non-technical member of teaching staff...

 

 

We do not have GAM/GCDS.

 

Our GSuite is not synced with AD.

 

 

Does anyone see a problem with this plan...

 

Create a new OU (YEAR 6 LEAVERS)

 

Put all the YEAR 6 LEAVERS on a .csv (from SIMS or by editing the original upload .csv)

 

Update users into the new OU by uploading the .csv

 

Select all users in that OU and delete...

[Ditto]

I think it would work but there are other options. Ultimately I think the school needs to reconsider having a non-technical member of staff trying to act as a systems administrator - I'm guessing they wouldn't be let loose on active directory and G Suite should be no different. The might consider getting a bolt-on admin tool - have a look at things like GoGuardian, Harpara, JumpCloud and there are others. For this specific case, you might want to look at Gopher - https://gsuite.google.com/marketplace/app/gopher_for_users/541463515699.

OK goldy might be another option - https://gsuite.google.com/marketplace/app/ok_goldy/939946549872

[DGardiner]

I did this last week because we were getting low on licenses.

Our domain is synced via GCDS. Users who are not present in AD are suspended from gsuite and not deleted.

The script I have relies on gam, and deletes users who's accounts are suspended and have not accessed them in 365 days. The first part of the script creates the csv. Presumably you won't need to do that part if you already have the csv. This is probably the easiest way, because it required zero intervention from your staff - they just need to upload the scv somewhere and the script runs as a cron. .

 

#!/bin/bash
export GAM_CSV_ROW_FILTER='{"lastLoginTime": "date<-365d"}'
gam print users query "isSuspended=True" lastlogintime |awk -F ',' '{print $1 }' >/tmp/userlist.csv
gam/gam csv /tmp/userlist.csv gam delete user ~primaryEmail

 

If youre just usiung the free edu licences open help on the admin panel and they will bump your licence count up - i got 10k added earlier in the year in about 10 minutes

[dmj]

Looking for the easiest way to accomplish this for a non-technical member of teaching staff...

 

I think this method probably is the simplest method for non-technical teaching staff: All they would have to do is drop a list of usernames into a pre-defined folder on a network share.

Your script would then process the file to remove users. could it really be simpler ?

 

We do not have GAM/GCDS.

 

It's free, well supported and takes 5min to setup. You can use this.

[Koldov]

I think it would work but there are other options. Ultimately I think the school needs to reconsider having a non-technical member of staff trying to act as a systems administrator - I'm guessing they wouldn't be let loose on active directory and G Suite should be no different. The might consider getting a bolt-on admin tool.

 

Thanks, unfortunately they are not really what you would consider a 'GSuite' school as such... We certainly don't use it normally day to day at the moment.

 

It was really just set up as a knee-jerk reaction to needing something for remote learning during lockdown.

 

All very last minute, with nobody really knowing what they were doing or why!

 

I supported them remotely as much as I could, it was all thrown at me after lockdown and I did the 'technical' setting up of domain for them etc. Then they just ran with it... They made themselves 'super' admins, created the classes and added the students etc.

 

The only question I can think of now then is when deleting multiple users does it ask individually if you want to 'keep data' or is that a setting they can turn off somewhere?

[dmj]

If youre just usiung the free edu licences open help on the admin panel and they will bump your licence count up - i got 10k added earlier in the year in about 10 minutes

 

I'm probably being a bit paranoid about keeping data longer than necessary !

[dmj]

Thanks, unfortunately they are not really what you would consider a 'GSuite' school as such... We certainly don't use it normally day to day at the moment.

 

It was really just set up as a knee-jerk reaction to needing something for remote learning during lockdown.

 

All very last minute, with nobody really knowing what they were doing or why!

 

I supported them remotely as much as I could, it was all thrown at me after lockdown and I did the 'technical' setting up of domain for them etc. Then they just ran with it... They made themselves 'super' admins, created the classes and added the students etc.

 

The only question I can think of now then is when deleting multiple users does it ask individually if you want to 'keep data' or is that a setting they can turn off somewhere?

 

To be honest I would go back and set it up properly, using an automated directory sync ( do you have a centralised directory such as LDAP, Active Directory or Azure?

I think this will be a better long term fix.

[Ditto]

Thanks, unfortunately they are not really what you would consider a 'GSuite' school as such... We certainly don't use it normally day to day at the moment.

 

It was really just set up as a knee-jerk reaction to needing something for remote learning during lockdown.

 

All very last minute, with nobody really knowing what they were doing or why!

 

I supported them remotely as much as I could, it was all thrown at me after lockdown and I did the 'technical' setting up of domain for them etc. Then they just ran with it... They made themselves 'super' admins, created the classes and added the students etc.

 

The only question I can think of now then is when deleting multiple users does it ask individually if you want to 'keep data' or is that a setting they can turn off somewhere?

Certainly in the OK Goldy add-on, it just deletes. Even after deletion you have 20 days to recover so you should be fine.

[Koldov]

could it really be simpler ?

 

I have to say (for me at least), if uploading a .csv to change OU works, then selecting all the users in that OU and selecting delete works... then yes that is simpler than installing and learning a new command line interface...

 

'If' it works...

 

To be honest I would go back and set it up properly, using an automated directory sync ( do you have a centralised directory such as LDAP, Active Directory or Azure?

I think this will be a better long term fix.

 

Yes, we run AD, but the children aren't on it (we could use SIMS maybe if there is an alternative way of doing that). As for going back and setting up the whole thing properly, if they decide to make GSuite a part of the school's general teaching & learning I have passed on your advice. As it is, at the moment I think it is fairly low down on the list of their priorities, as long as they can get the 'majority' of students to do 'some' work whilst at home I think they are happy...

 

The only other thing I can see as a problem is that they obviously started off a little half-cocked... Going to an automated system now would mean a lot of issues with the naming convention they used (I can see lots of students being re-enrolled, needing new log-ins etc).

 

I have pulled student data from SIMS and from GSUITE to compare and the names have been taken from a mix of 2 reports! One using preferred forename or surname and the other legal forename and surname.... then to make it worse some that have long, similar or confusing names have been manually altered using a mix of both and some with the same name have had middle names added... I think an automated system now would make quite a mess... unless we started the whole thing from scratch!

Edited September 22, 2020 by Koldov