Departing users

[John Shearer]

Greetings collective.

This is both a GAM question and 'what are other Google admins doing' question.

Our HR wants to adopt a policy that all departing employees will have an auto reply.  As we all know, a disabled/suspended account cannot auto-reply.  

What we have done is rename the account (add '-DNU' [for Do Not Use] to the end of their email), and remove the alias to their original name that was created.  Then in another account, we add an alias to their old email, create an auto-response template, then make a filter to file the message and send the auto response.

I'm sure most of this could be done in GAM with some creativity, but does anyone else have a great solution?  This isn't so bad when it's onesy-twosy for high profile accounts, but there is talk about making it standard procedure.

Thanks!

--

John D. Shearer P '05 '18, Associate Director

Department of Information Technology

Northfield Mount Hermon

p: 413-498-3680

jshe...@nmhschool.org

One Lamplighter Way, Mount Hermon, MA 01354  nmhschool.org

NMH CONFIDENTIALITY NOTICE: This transmission may contain privileged and confidential information, including information protected by federal and state privacy laws such as HIPAA and FERPA. It is intended only for the use of the person(s) named above. If you are not the intended recipient, please contact the sender by reply email or by telephone, and destroy all copies of the original message.

[Adrian Warren]

I don't have a GAM solution, but we keep the account around for 30 days admins take over the account, change MFA, etc... and store in in a shared password manager. Auto reply for 30 days.

After 30 days if the email needs to stay within a group, usually the manger gets the mailbox content and then the alias of the previous account to the manager.

If we need to hang on to it I have an archive user account the mailbox content can go into. That account gets then cleaned up based on retention policy.

[Paul Ogier]

Anything in the departing user’s own mailbox dies when you suspend them. Vacation responder stops, Gmail-level forwarding stops. Moving the auto-reply onto a live account is the only place it survives, so you’ve already got the right answer.

Two possible shortcuts. The recipient address map redirects mail while the user still exists, so the rename becomes optional: Apps, Google Workspace, Gmail, Default routing, change envelope recipient. It only moves mail, so you’d still want the filter and canned response on the receiving side. GAM can’t configure default routing though, so that step stays manual. Aliases and groups it does fine.

And if you keep the rename, the -DNU account is a dead and still costing you a licence. Deleting it once the data is off frees the licence and the address. Google lets you reassign a deleted address to another managed user inside 20 days, the same window you’d have to restore the account if something turns up missing.

We script ours end to end and it prints those capture options at the end of every run. Open source if it helps.

https://github.com/PaulOgier/GAMScripts/tree/main/OffBoarding%20Google%20Workspace%20Users

Paul