Google Workspace Domain audit #
GAT+ provides an extensive Google Drive audit for the entire Google Workspace domain.
Admins can search by user and see all Drive events done by that user in a specific set of times.
Google Drive events #
Navigate to GAT+ > Drive > Events
This will show you all Drive events happening domain-wide.
Apply filter #
In the Events tab open and apply a filter.
In the filter enter the options:
- Type – Simple filter
- Email equal – enter the user needed
- Date (relative) – select the time needed (in the last x days)
- Additional filters can be also used
- Event – enter specific event interested
- Date – enter a date after/before a certain time.
The filter will display all events done by the selected email address in the time relative (till now) – in the last x days (from the time filter is applied).
- Email – is the user who did the event on Drive
- Event – the event that happened on the Drive file
- Shared drive membership change – change to shared drive was applied
- Document access scope changed – sharing permission on the files/folders was applied
- Visibility change
- ACL Change
- Contributors can’t share
- Add to Folder
- Remove from folder
- Sheet import range
- Email as attachment
- Filters can be applied to each and combination of events