"gam report admin event SUSPEND_USER" Giving Wrong Admin

182 views
Skip to first unread message

Dale Courtney

unread,
Aug 20, 2021, 10:25:38 PM8/20/21
to GAM for Google Workspace
I ran the following report to see who suspended a user in my system. 

     gam report admin event SUSPEND_USER

The report came back saying that my SysAdmin suspended various users, but I know for a fact that I ran the GAM command to do so with my credentials. 

Any idea why the report would come back otherwise? 

I'm running GAMADV-XTD3 6.07.08

Thanks. 

Best,
Dale

Ross Scroggs

unread,
Aug 20, 2021, 10:35:29 PM8/20/21
to google-ap...@googlegroups.com
Dale,

Do: gam oauth info

What's this value? Google Workspace Admin: 

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/e7e94b0b-2e62-4371-adab-e563a454a588n%40googlegroups.com.

Dale Courtney

unread,
Aug 21, 2021, 12:03:57 PM8/21/21
to GAM for G Suite
Google Workspace Admin: dale.c...@economicmodeling.com

But when I run the following report
     gam report admin event SUSPEND_USER

I get the following: 

I ran the GAM command to suspend that terminated user, but it shows up on the report as having been suspended by my Helpdesk Manager (who isn't using GAM). 

best,
Dale


To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/6C8CE764-A385-44D1-9046-B86CA6BBCDCD%40gmail.com.

Jay Lee

unread,
Aug 21, 2021, 12:57:01 PM8/21/21
to google-ap...@googlegroups.com
Check the admin console audit log. It should show the same as GAM.

Jay

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAG56vfPsda-Otd3crEqOcmqJAb2VWggAuG%3D9wkzUR4X%2BVW7txA%40mail.gmail.com.

Dale Courtney

unread,
Aug 24, 2021, 11:24:50 AM8/24/21
to GAM for G Suite
Jay: the Google Admin Console does show the same thing as GAM: that my HelpDesk admin did the suspension. But we know for a fact that I did it with my GAM account. 🤷🏻‍♂️

best,
Dale


To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CA%2BVVBp-Ao%3D5RMP01aYF4iw_pPSEhSVbwSzzFYbMD%3DqHbw5YsHA%40mail.gmail.com.

Jay Lee

unread,
Aug 24, 2021, 11:36:34 AM8/24/21
to google-ap...@googlegroups.com
Then there are two possibilities:

1) Google auditing recorded the wrong admin for the operation.
2) you got your facts wrong somewhere along the line.

Personally, I'd assume #2 until I can absolutely prove it wasn't #2. But in general, this doesn't seem to be a GAM issue. GAM just performs the API calls it's told to using the credentials it has. Google's auditing is responsible for recording what that action was and who did it.

Jay Lee


To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAG56vfMgtpCwkiJGA-TT1ZwBPpev7Q3SVKAddQpnXWsd0e6xGQ%40mail.gmail.com.

Dale Courtney

unread,
Aug 24, 2021, 11:46:22 AM8/24/21
to GAM for G Suite
Jay 

It's so weird because when I run 
gam oauth info
I get
Google Workspace Admin: dale.c...@economicmodeling.com


best,
Dale


To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CA%2BVVBp_hR8PDosVUuo62rThAdbW-1WfmKSTOGHhgNHmVD%2BW2rw%40mail.gmail.com.

Ross Scroggs

unread,
Aug 24, 2021, 11:50:24 AM8/24/21
to google-ap...@googlegroups.com
Dale,

Does the timestamp on the event give you any useful information? Does it match you memory of when you performed the suspension?

Ross

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAG56vfO5Fw8yYWuWZCkwio%2B5ft0FNhb_JAb1qUdORC2hdygcWQ%40mail.gmail.com.


--
Reply all
Reply to author
Forward
0 new messages