View any action taken in Google Drive by a specific user

Google Workspace Domain audit #

GAT+ provides an extensive Google Drive audit for the entire Google Workspace domain.

Admins can search by user and see all Drive events done by that user in a specific set of times.

Google Drive events #

Navigate to GAT+ > Drive > Events

This will show you all Drive events happening domain-wide.

Apply filter #

In the Events tab open and apply a filter.

In the filter enter the options:

  • TypeSimple filter
  • Email equal – enter the user needed
  • Date (relative) – select the time needed (in the last x days)
  • Additional filters can be also used
    • Event – enter specific event interested
    • Date – enter a date after/before a certain time.

Result #

The filter will display all events done by the selected email address in the time relative (till now) – in the last x days (from the time filter is applied).

  • Email – is the user who did the event on Drive
  • Event – the event that happened on the Drive file
    • Shared drive membership change – change to shared drive was applied
    • Document access scope changed – sharing permission on the files/folders was applied
    • Visibility change
    • ACL Change
    • Contributors can’t share
    • Download
    • Upload
    • Edit
    • Print
    • View
    • Create
    • Move
    • Delete
    • Rename
    • Preview
    • Add to Folder
    • Remove from folder
    • Trash
    • Untrash
    • Sheet import range
    • Email as attachment
    • Unknown
  • Filters can be applied to each and combination of events

Relevant How-tos:

This website uses cookies to ensure you get the best experience on our website