Google Workspace field guides.
Practical notes on how Google Workspace actually behaves, based on real district-scale administration. No product knowledge required.
K-12 operations
The Google Workspace summer rollover checklist for K-12
Rollover is four populations, one hard deadline, and an ordering constraint that will merge two grade levels if you get it backwards. Most of the work is decisions made in May, not clicks made in July.
Graduating students: suspend, transfer, archive, or delete?
There is no single right answer, but there is a right order. Students can only move their own work while they can still sign in, and two separate settings have to be on before the transfer tool works at all.
What actually has to happen when a teacher leaves your district
Suspending the account is the easy part. The work is everything attached to it: Drive ownership that does not transfer the way you expect, delegation nobody remembers granting, and a deletion window that closes permanently after twenty days.
ChromeOS and devices
Why your ChromeOS device counts don't match Google Admin Console
Two systems read the same Google Workspace tenant and report different Chromebook totals. It is almost always deprovisioned devices or a child organizational unit roll-up. Google documents the behavior without documenting its consequence.
Disable, deprovision, or delete? What actually happens to a Chromebook
Disabling and deprovisioning a ChromeOS device do very different things, and deleting one is not an option Google offers at all. The deprovision reason you pick is a license decision, and picking the wrong one can cost you the license permanently.
Administration and security
How long do Google Workspace directory changes take to appear?
We measured it. Unsuspending an account was visible on a direct account lookup faster than we could detect, and took about eleven seconds to reach the filtered lists and searches administrators actually look at. Google's own published bound is far more conservative.
How to clean up years of old Google Groups without breaking everything
A group is four things at once and only one of them is visible from the Groups list. Deleting it revokes every permission it was silently holding, and in a school the things that break are the ones that only happen once a year.
What to check after a Google Workspace account is compromised
Resetting the password is not containment. The controls overlap, but no single one of them covers everything — and the persistence someone leaves behind survives all of them if you do not go looking for it specifically.
Phishing and incident response
Google Drive share phishing: why the email is real and the document is malicious
A Drive share email from drive-shares-dm-noreply@google.com can be genuine Google mail that passes SPF, DKIM and DMARC, and still deliver a phishing document. What is happening, what Google catches, and what to tell staff.
How to investigate a malicious Google Drive share in Google Workspace
A staff member reports a shared document that turned out to be phishing. What to capture first, how to identify the account that actually shared it, what your Drive and Gmail logs can and cannot show for a file your organization does not own, and where the edition line falls between Education Fundamentals, Standard and Plus.
How to remediate Google Drive share phishing in Google Workspace
An incident-response workflow for a malicious Drive share that reached your staff: what to preserve, how to pull the notification out of inboxes on each Education edition, what can and cannot be done about the shared file itself, and how to close it out. Education Fundamentals and Standard/Plus are handled separately, and so is the ORINEX Compliance workflow.
Blocking drive-shares-dm-noreply@google.com won't stop Drive share phishing
drive-shares-dm-noreply@google.com is a Google-controlled Drive notification address. Blocking it can suppress legitimate notifications sent from that address while leaving the malicious shared file in place. What you can block instead, and what each block does.
Using Gmail content compliance to quarantine Google Drive phishing
Gmail's content compliance rules can examine the headers and body of inbound mail and quarantine, reject, or modify what matches. A methodology for turning one preserved Drive-share phishing notification into a rule that catches the campaign without touching legitimate Drive notifications, and why there is no universal rule to copy.
Can a Google Workspace admin delete a phishing email from everyone's inbox?
Yes on Education Standard and Plus, from the Admin console's security investigation tool. On Education Fundamentals the console can tell you who received it but cannot remove it; removal needs the Gmail API through GAM or another tool. An edition-by-edition comparison of what your license actually gives you, verified against Google's documentation.
How to reduce Google Drive share phishing in Google Workspace
There is no setting that safely eliminates Drive-share phishing for every district without also affecting legitimate external collaboration. What Google's own protections do, the difference between users sharing files out and users receiving files in, where the allowlist and trust rules draw the line and which editions have them, and a K-12 approach that tightens receiving where it costs the least.
K-12 impersonation phishing: why attackers pretend to be superintendents, HR and finance
The lures that work on school staff borrow the names on the district letterhead and the routines those names control: payroll, benefits, evaluations, payments. Why those roles, how the messages arrive (including through Google's own Drive notifications), why a familiar name beats an unfamiliar address, and what district IT can actually do about it.
Why SPF, DKIM and DMARC don't stop Google Drive share phishing
SPF, DKIM and DMARC authenticate the domain that sent a message, and they work. A Google Drive share notification is sent by Google, so it authenticates as Google's, correctly, while the account that shared the file, the document and the link inside it sit outside anything authentication examines. A short, sourced explanation of why a pass is expected and what it does and does not tell you.
GAM guides
How to install and set up GAM7 for Google Workspace
Install GAM7 on Windows, macOS or Linux, create its Google Cloud project and authorize it for your domain. Includes the service account key upload error newer Google Cloud organizations hit, and how to allow the upload for the GAM project alone.
How to remove a user from all Google Groups with GAM
One GAM7 command takes a user out of every group they belong to. Here is the command, the preview to run first, and what it does that is easy to miss: owned groups, nested groups, and everything that was shared to those groups.
How to find every Google Group a user belongs to with GAM
One GAM7 command lists the groups a user was added to. A second lists those groups and the groups they sit inside, which is what decides what the person can actually reach. Here are both.
How to move Google Workspace users to another OU with GAM
GAM7 moves one user, or everyone in an organizational unit, with a single command. Here is each form, the preview to run first, how to leave suspended accounts where they are, and how long the new settings take to apply.
How to list suspended users with GAM
One GAM7 command lists every suspended account in your domain. Here is the command, the form Google uses in its own examples, and why the list matters more than it looks: suspension by itself does not free an account's license.
How to sign a user out of Google Workspace with GAM
One GAM7 command signs a user out of every web and device session. Here is the command, what Google says about how fast it takes effect, and why a district that uses single sign-on needs one more step.
How to archive suspended users with GAM
Google publishes its own GAM command for archiving every suspended account in an Education domain. Here it is, the preview to run first, and what archiving changes: the license it frees, and what it takes to bring an account back.
How to transfer Google Drive ownership with GAM7
The GAM7 transfer drive command moves a user's Drive files to a new owner. The exact command and its preview, when to use gam create datatransfer instead, and what happens to trashed files.
How to deprovision Chromebooks safely with GAM
GAM7 deprovisions a Chromebook with one command and two safety catches built in. Here is the preview, the command, the reason you have to choose, and what deprovisioning means for the device afterwards.
How to find users suspended for more than 90 days with GAM
GAM7 can select suspended accounts by how long ago they were disabled. Here is the 90-day command, how its options fit together, and the one combination that quietly includes archived accounts too.
How to export Google Groups and their members with GAM
One GAM7 command exports every group in your domain with its members, one row per membership. Here is the command, how to expand nested groups into the people inside them, and which of the two exports to keep.