Google Workspace Domain audit #

GAT+ provides an extensive Google Drive audit for the entire Google Workspace domain.

Admins can search by user and see all Drive events done by that user in a specific set of times.

Google Drive events #

Navigate to GAT+ > Drive > Events

This will show you all Drive events happening domain-wide.

Apply filter #

In the Events tab open and apply a filter.

In the filter enter the options:

• Type – Simple filter
• Email equal – enter the user needed
• Date (relative) – select the time needed (in the last x days)
• Additional filters can be also used
  • Event – enter specific event interested
  • Date – enter a date after/before a certain time.

Result #

The filter will display all events done by the selected email address in the time relative (till now) – in the last x days (from the time filter is applied).

• Email – is the user who did the event on Drive
• Event – the event that happened on the Drive file
  • Shared drive membership change – change to shared drive was applied
  • Document access scope changed – sharing permission on the files/folders was applied
  • Visibility change
  • ACL Change
  • Contributors can’t share
  • Download
  • Upload
  • Edit
  • Print
  • View
  • Create
  • Move
  • Delete
  • Rename
  • Preview
  • Add to Folder
  • Remove from folder
  • Trash
  • Untrash
  • Sheet import range
  • Email as attachment
  • Unknown
• Filters can be applied to each and combination of events

Relevant How-tos:

• Who read what google drive doc and when
• How to track visitors and editors of specific doc