Disable users not active in last 90 days

3,513 views
Skip to first unread message

Bryan Guidroz

unread,
Sep 27, 2018, 10:21:24 PM9/27/18
to GAM for G Suite
This works perfectly for devices: 

I'm looking to do something similar for users.
If an active user in a specific OU has a last login 90 days ago or more, I want to disable their account.
I was hoping the command below would work, but it doesn't.

./gam print users query "orgUnitPath='/Staff/Site 001' isSuspended=false lastlogintime:..#querytime1#" querytime1 -90d
Command: ./gam print users query "orgUnitPath='/Staff/001 Staff' isSuspended=false lastlogintime:..#querytime1#" >>>querytime1<<< -90d

ERROR: Invalid argument

Suggestions with gamadv-x?

Ross Scroggs

unread,
Sep 28, 2018, 9:27:01 AM9/28/18
to google-ap...@googlegroups.com
Bryan,

Here is the query documentation for users: https://developers.google.com/admin-sdk/directory/v1/guides/search-users
There is no ability to query for lastLoginTime.

You'll have to filter the list yourself.

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/c25432e1-bdfd-47d9-a14e-73318a5a69ec%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Bryan Guidroz

unread,
Sep 29, 2018, 11:16:47 PM9/29/18
to GAM for G Suite
I can filter the list myself, but...
This command looks to ALMOST give me what I need.

./gam report users parameters accounts:is_suspended filters "accounts:is_disabled==False" parameters accounts:last_login_time filters "accounts:last_login_time<#filtertime1#" filtertime1 -90d fields accounts:last_login_time,accounts:is_suspended > junk.csv

But I have 3 questions.

1. This may be a stupid question, but what's the difference between is_suspended and is_disabled exactly?

2. When you combine filters like this, is it an AND or an OR operator between them?  
In this example, is it:
account is disabled=False AND last login time more than 90 days ago or..
account is disabled=False OR last logintime more than 90 days ago
(I need AND)
I want a list of users that are not disabled/suspended AND haven't logged in in the last 90 days.
I'll then disable thost users.

3.  This doesn't give me exactly what I need because I can't select the user's OU.  
I only want to include employees, not students.
Guess that isn't possible since the user's OU isn't listed here:

Thanks for the help.



On Friday, September 28, 2018 at 8:27:01 AM UTC-5, Ross Scroggs wrote:
Bryan,

Here is the query documentation for users: https://developers.google.com/admin-sdk/directory/v1/guides/search-users
There is no ability to query for lastLoginTime.

You'll have to filter the list yourself.

On Sep 27, 2018, at 7:21 PM, Bryan Guidroz <bryang...@tpsdonline.org> wrote:

This works perfectly for devices: 

I'm looking to do something similar for users.
If an active user in a specific OU has a last login 90 days ago or more, I want to disable their account.
I was hoping the command below would work, but it doesn't.

./gam print users query "orgUnitPath='/Staff/Site 001' isSuspended=false lastlogintime:..#querytime1#" querytime1 -90d
Command: ./gam print users query "orgUnitPath='/Staff/001 Staff' isSuspended=false lastlogintime:..#querytime1#" >>>querytime1<<< -90d

ERROR: Invalid argument

Suggestions with gamadv-x?

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.

Ross Scroggs

unread,
Sep 30, 2018, 9:47:05 AM9/30/18
to google-ap...@googlegroups.com
Bryan,


2: AND

3: Try something like this. You don't need the filters "accounts:is_suspended==False" as the suspended users are eliminated with ou_ns in print users.
gam ou_ns /Employees print users primaryEmail | gam redirect csv ./junk.csv multiprocess redirect stderr - multiprocess csv - gam report users user ~primaryEmail filters "accounts:last_login_time<#filtertime1#" filtertime1 -90d fields accounts:last_login_time,accounts:is_suspended

This will run slower as the is an API call per user.

Ross

To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

Bryan Guidroz

unread,
Sep 30, 2018, 11:00:54 AM9/30/18
to GAM for G Suite
Thanks...
I'm playing around with this and this is what I get.
The "School Staff" ou does exist.

./gam ou_ns '/School Staff' print users primaryEmail
Getting all Users directly in the Organizational Unit for /School Staff, may take some time on a large Organizational Unit...
Organizational Unit: /School Staff, Does not exist
Command: ./gam ou_ns >>>"/School Staff"<<< print users primaryEmail

ERROR: 1 Organizational Unit Does not exist in source marked >>> <<< above

Ross Scroggs

unread,
Sep 30, 2018, 11:08:41 AM9/30/18
to google-ap...@googlegroups.com
Bryan,

Do: gam info org "/School Staff"
Do: gam redirect csv ./OUList.csv print orgs
Is "/School Staff" in the orgUnitPath column?

To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

Bryan Guidroz

unread,
Sep 30, 2018, 11:34:43 AM9/30/18
to GAM for G Suite
Sorry... You can ignore... A few weeks ago, I renamed the OU from School Staff to just Staff... And I forgot.
It's working as expected.
Will see if your suggestion gives me what I need.
Thanks Ross... 

+KimNilsson

unread,
Oct 11, 2018, 5:19:26 AM10/11/18
to GAM for G Suite
#3 Ross, since you use redirect and multiprocess here, would it be safe to assume that this will be a two-step process, where one has to use the resulting csv to in a second command to suspend the inactive users?

/Kim

Ross Scroggs

unread,
Oct 11, 2018, 8:26:22 AM10/11/18
to google-ap...@googlegroups.com
KIm,

Yes. After inspecting junk.csv you could do either of the following:
Serial: gam update users csvfile junk.csv:email suspend on
Parallel: gam csv junk.csv gam update user ~email suspend on

Ross
--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
Reply all
Reply to author
Forward
0 new messages