How to remove suspended users who have been suspended for 6 months

[Jacobo Garrido]

Hi guys,

I would like to create a script what I remove suspended users who have been suspended for 6 months, with GAM it is possible?

Thanks 

[Kim Nilsson]

I've spent a lot of time trying to come up with something fancy, but you could instead use the automatic value of lastLoginTime combined with OU and suspended status.

gam config csv_output_row_filter "lastLoginTime:date<-180d" print users lastlogintime suspended query "orgUnitPath='/Terminated Users' isSuspended=True"

This will give you a list of users who are suspended, in the /Terminated Users ou and haven't logged in in 180 days.

Yes, that could also catch a user that was suspended yesterday, put in the right OU, but hasn't logged in for six months.

But, it feels like that account is ripe for deletion anyway.

[Kim Nilsson]

An alternative is a process where all suspended accounts are altered in some way, adding the date somewhere on the user account, or put in a dated OU.

Something which can later be read back and acted upon, and still be true.

Reading the Reports API for old suspension activities may not still be true, as the user may have been activated and deactivated several times in the last 6 months.

Reading the Reports API for fresh activities can be used to act on the account, however.

Maybe something like this, run once every day.

$ cat bin/set-suspension-date

#!/bin/bash

TODAY=$(date +'%Y%m%d')

OLDDATE=$(date --date="-180 day" +'%Y%m%d')

echo $TODAY

echo $OLDDATE

# This will create a new OU for users suspended today, for whatever reason.

/home/user/gamadv-xtd3/gam create ou /Suspended/$TODAY

# This will find all users suspended within the last 24 hours and move them to TODAY's dir in the /Suspended structure. (1)

/home/user/gamadv-xtd3/gam report admin event SUSPEND_USER start -24h | /home/user/gamadv-xtd3/gam csv - gam update user ~USER_EMAIL ou /Suspended/$TODAY

# This is just to display which users are now in TODAY's suspended dir. Can be commented out.

/home/user/gamadv-xtd3/gam print users limittoou /inaktiverade/$TODAY

# This will display all users in the OU created 180 days ago. Can be commented out.

/home/user/gamadv-xtd3/gam print users limittoou /inaktiverade/$OLDDATE

# This will delete all users in the OU created 180 days ago.

/home/user/gamadv-xtd3/gam delete users ou /inaktiverade/$OLDDATE

# This will delete the 180 day old no longer necessary OU. Do note that it will only be deleted if it is truly empty.

/home/user/gamadv-xtd3/gam delete ou /Suspended/$OLDDATE

# (1) It doesn't really matter that we may catch a user twice (around daylight savings time), because it will only offset the final deletion by one day.

[Ross Scroggs]

Jacobo/Kim,

Here's a thought.

gam config csv_output_row_filter "accounts.is_suspended:boolean:true" report user user all parameters accounts:is_suspended,accounts:disabled_reason

You'll have to filter the rows to select the 180 day requirement.

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/06fdfbf0-8a36-4103-9dab-6674b2b16628n%40googlegroups.com.

--

Ross Scroggs

ross.s...@gmail.com

[Kim Nilsson]

OMG!

SERIOUSLY?

The date is now included in the reason!

[Kim Nilsson]

This is what it looks like to me.

The date syntax looks weird (to me).

Disabled by operator (2020/07/02-03:15:53.848)

But as long as XTD3 recognises that as a date it should be ok. (I'm guessing it doesn't, see below.)

Still I have no really good idea how to write such a filter.

The date is part of a string, so not a date value, which should rule out the date attribute of row_filter, right, Ross?

One could use regex, and use today's date, formatted the same way, and if it matches, act on it.

***** here comes Kim's wishlist *****

Or if XTD3 could parse that string and put the date part in a separate column, like it does with activeTimeRanges...

There would be sooo much love coming from this part of the world! :-)

regexr says [0-9/]{4}/[0-9/]{2}/[0-9/]{2} should find the date part of the string.

[Ross Scroggs]

Kim's wish is granted.

5.08.12

Updated `gam report users` to create a column `accounts:disabled_time` from the timestamp in the column `accounts:disabled_reason`.

This makes it possible to filter on the time. For example, to see all users suspended more than a year ago:

```

gam config csv_output_row_filter "accounts.is_suspended:boolean:true,accounts.disabled_time:date<-1y" report user user all parameters accounts:is_suspended,accounts:disabled_reason

```

Ross

--

ross.s...@gmail.com

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAGPzzFv%3D0J6p4PpC4DVZhuH6JBfWx2OHe5D_jt_XjQua4N5Wyw%40mail.gmail.com.

[Kim Nilsson]

AAAAAAAAAAAAAAAAAAAAAHHHHH!

Ross you are the most amazing person ever!

Worked like a charm!

@Jacobo, so to fit your request of 6 months you use -180d to list those users. Then delete them.

Do note that this is a very unforgiving command. If you type the wrong number of days, it will still delete them.

gam config csv_output_row_filter "accounts.is_suspended:boolean:true,accounts.disabled_time:date<-180" report user user all parameters accounts:is_suspended,accounts:disabled_reason | gam csv - gam delete user ~email

Safer to do it in two steps, until you are sure it works as you want.

gam config csv_output_row_filter "accounts.is_suspended:boolean:true,accounts.disabled_time:date<-180" report user user all parameters accounts:is_suspended,accounts:disabled_reason > ./deleteSuspendedUsers.csv
Review the list.

Then delete them.

gam csv  ./deleteSuspendedUsers.csv gam delete user ~email  

/Kim

--

There is No Substitute!

[Iain Macleod]

Thank you Ross! 

Just wanted to correct a slight typo in your command Kim, the 180 is missing a "d" after it to tell GAM it is days.

gam config csv_output_row_filter "accounts.is_suspended:boolean:true,accounts.disabled_time:date<-180d" report user user all parameters accounts:is_suspended,accounts:disabled_reason | gam csv - gam delete user ~email

 gam config csv_output_row_filter "accounts.is_suspended:boolean:true,accounts.disabled_time:date<-180d" report user user all parameters accounts:is_suspended,accounts:disabled_reason > ./deleteSuspendedUsers.csv

[Dale Courtney]

I'm running GAMADV-XTD3 5.08.19

I ran Iain's and Ross' script:

 

gam config csv_output_row_filter "accounts.is_suspended:boolean:true,accounts.disabled_time:date<-180d" report user user all parameters accounts:is_suspended,accounts:disabled_reason > ./deleteSuspendedUsers.csv

And got the following error: 

WARNING: csv_output_row_filter column "accounts.disabled_time" does not match any output columns

best,

Dale

---

_{Notice to recipient: This e-mail is only meant for the intended recipient of the transmission, and may be a confidential communication or a communication privileged by law. If you received this e-mail in error, any review, use, dissemination, distribution, or copying of this e-mail is strictly prohibited. Please notify us immediately of the error by return e-mail and please delete this message from your system. Thank you in advance for your cooperation.}

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/dd5488ba-34d1-405e-8a68-6fe6e4b7e835o%40googlegroups.com.

[Iain Macleod]

I was able to run the command on version 8.08.18 and after upgrading to 8.08.19. 

Are you sure you have users who were suspended over 6 months ago? Maybe try lowering the threshold from 180d to 30d and see if it works.

You received this message because you are subscribed to a topic in the Google Groups "GAM for G Suite" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-apps-manager/lC5GtiMFjq0/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAG56vfN2Hwnut-tm4w%3DVtykqeEG%3Dsjc5HhYxUtd1P7ckzc3LNg%40mail.gmail.com.

[Kim Nilsson]

Just so everyone is aware, this process is currently broken, on Google's side. Nothing wrong with gam.

Case 38716464

The API doesn't list suspended dates after 2021-04-29 (that's the closest date that I can find).

/Kim

[Brodie McBeath]

Hey Kim,

Fellow GSFE member here and just now dipping my toes in to GAM. Ran Ross's script yesterday and was excited to see that it pulled results. Just saw your update on the API not listing suspended dates after 2021-04-29. Has this case been resolved? I don't recall having this issue.

Appreciate you guys!

[Kim Nilsson]

Hiya, Brodie!

Are you getting recent dates when you run it? 

/Kim 

[Brodie McBeath]

Oh lord... We are in 2022.... Kim you are correct. I didnt even catch that. Its been a week. Currently its up to 2021-05-05.

The report I happen to be generating was for 90 days and never once batted an eye at 2021.

Thanks Kim.