I need to run a report for drive events by OU and by owner. I am wanting to find files and folders that still have people viewing and editing them even though the owner of the file has a suspended account.
I have 2 GAM commands that I have been working on but neither one is giving me exactly what I need.
- The first one returns all of the drive events were the users in the OU are Actors, but I need to see the drive events where all of those users are owners.
gam report drive OU <OU-Path> events view,edit
- The second command returns all of the users but fails to pass the primaryEmail to the second part of the command. In the second part of the command I am able to specify a single email address which returns what I am looking for however I need this to be dynamic so that it ban repeated for all accounts in the OU.
gam print users query "orgUnitPath='/Path/To/OU'" | gam csv - gam report drive filter "owner==~primaryEmail" events edit,copy,download,print,view todrive
Any idea?
Thanks